65f963bc3c4466d55ecb3f15295be97eaad188c9c73f4bef241c3bf46d95b4f3

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 11:40

Target

vk_swiftshader.dll
Size

4.9MB
MD5

e53fd0779465c910b275f93abafa6e3e
SHA1

f38f2711805d08b4b6d29b0a49253db0da939fcd
SHA256

58e2b5ab33366550207ed8e1f420b24c94b19fbe8e753f5a6c038beb829533a7
SHA512

934e8e68042d1adcf17efc1fbe728930ecb2d6cbc0fd60ad064e28e18ed2a57fffc7331b2eb807f6972c0c37bb9acc69c97a137b264efab67e180a8fe0d1cdc3
SSDEEP

49152:z6PkZFjKeDTIEvAvlo6coVQxa8sVr0yN1J+MuXy557nDOPNt7wpr30sN+05uQKY1:zNZFjAgpOz2VeCCAkEvkCvGZf9z

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2068	2064	rundll32.exe	31
PID 2064 wrote to memory of 2068	2064	rundll32.exe	31
PID 2064 wrote to memory of 2068	2064	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2064 -s 80
  2⤵
  PID:2068