c765f61cee33c326acc4ea19256267c35129a1ec7edb567fe0b5ed9a88e3d6b1

Analysis

max time kernel
11s
max time network
22s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/08/2024, 22:09

Target

vk_swiftshader.dll
Size

4.9MB
MD5

f16c36ae369609497bfd0847889bec63
SHA1

5dca218bf0b2a20d7d027fa10fdb1b8152564fe4
SHA256

4488a958418227fbe6f64898c2f85eefd87fc9e46aea457233b38db8a86e944d
SHA512

9f06f4a318c8a3e2fdccb6d983087184cff37a2b79e0c1e85b3ac8e45695454c4aacb4468593ebbfff64739b0d598ba4d1d9dd94187b1bbd82c1369c62781109
SSDEEP

49152:56h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzZ:sh3aMXoSHfPwksHldLiuNr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1344	2136	rundll32.exe	29
PID 2136 wrote to memory of 1344	2136	rundll32.exe	29
PID 2136 wrote to memory of 1344	2136	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2136 -s 84
  2⤵
  PID:1344