46e1f4257b5fbfbfbdcdb11eeafa0b91893385cf28972eb672ffc9fe906175ab

Resubmissions

28/07/2024, 17:32

28/07/2024, 17:11

11/07/2024, 10:44

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/07/2024, 17:32

Target
vk_swiftshader.dll
Size 5.1MB
Sample240728-v397layfmg
SHA256 5b2ffb78fa963f2dea5a7fcf7676fc3aba243c4372d7528c8f1fc8f726d0a3fa
MD5 524b0d85d992f86a7f26c162f3dbb91c
SHA1 bc9c862fd01f6134a0514dcb63f9fab7a61ce269
SHA512 422a18af294d7551224e05f5f4f5dcfa51b3455c2e61fc285fd2b95b50274eb77ff317647e17b0e7d47459b4fed19c7c88c90e0878f2269a78d598b1196401d8
SSDEEP 98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3048	3032	rundll32.exe	31
PID 3032 wrote to memory of 3048	3032	rundll32.exe	31
PID 3032 wrote to memory of 3048	3032	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3032 -s 80
  2⤵
  PID:3048