34e141c88f20dffe25bf118a427415ce55cbc123848a2f6d2d5ccfe390a746ec

Analysis

max time kernel
84s
max time network
205s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
23/07/2024, 09:31

Target

Wave/CrackedWave/vk_swiftshader.dll
Size

4.4MB
MD5

0ec149455727ace9acc09b3ba2c3a2b2
SHA1

6eeb990876cef6a34115b67f3190255db589f723
SHA256

e2d8ef53897e864b5b66bc73606681c99461798a9f4c1e13ca5cef7bc774d7fd
SHA512

c8eaa598c9439b1f2375fdac1f58896853510bddbd640707b9142c0d3793836120b28d7c2bd0407f0d5656dd19f14b312f37b7ac0165c9cc8b4c1a0f2af62531
SSDEEP

98304:ZJ2CfZE7/v0+gfnaacHIhXH6jMofF4DSaaHSyh2z7mGpG:u73lA36jvcSaaHSGGG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	656	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 656	752	rundll32.exe	78
PID 752 wrote to memory of 656	752	rundll32.exe	78
PID 752 wrote to memory of 656	752	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wave\CrackedWave\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wave\CrackedWave\vk_swiftshader.dll,#1
  2⤵
  PID:656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 456
    3⤵
    - Program crash
    PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 656 -ip 656
1⤵
PID:2164