34e141c88f20dffe25bf118a427415ce55cbc123848a2f6d2d5ccfe390a746ec

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 18:26

Target

Wave/CrackedWave/vk_swiftshader.dll
Size

4.4MB
MD5

0ec149455727ace9acc09b3ba2c3a2b2
SHA1

6eeb990876cef6a34115b67f3190255db589f723
SHA256

e2d8ef53897e864b5b66bc73606681c99461798a9f4c1e13ca5cef7bc774d7fd
SHA512

c8eaa598c9439b1f2375fdac1f58896853510bddbd640707b9142c0d3793836120b28d7c2bd0407f0d5656dd19f14b312f37b7ac0165c9cc8b4c1a0f2af62531
SSDEEP

98304:ZJ2CfZE7/v0+gfnaacHIhXH6jMofF4DSaaHSyh2z7mGpG:u73lA36jvcSaaHSGGG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	4288	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4288	4628	rundll32.exe	87
PID 4628 wrote to memory of 4288	4628	rundll32.exe	87
PID 4628 wrote to memory of 4288	4628	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wave\CrackedWave\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wave\CrackedWave\vk_swiftshader.dll,#1
  2⤵
  PID:4288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 600
    3⤵
    - Program crash
    PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4288 -ip 4288
1⤵
PID:4984