030de2abcea938201bbb22786107967b412a4fd9a97ed39e09a4063fcbf88b2f

Resubmissions

11/08/2024, 22:04

11/08/2024, 22:02

max time kernel
10s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 22:02

Target

vk_swiftshader.dll
Size

5.0MB
MD5

583b1d71cd7b847ba02d734c508cd92f
SHA1

d63966aeafa951d51967620c606e9b97399699c4
SHA256

680ea3717671c896d516517ff322976ab708f18862135be4216a27ad57353dcc
SHA512

cbb0659ccac9344ed9bb151443a30c106711fa1b15234e6f1225ef28a679c6b3f0a24a6ca1d9baff46155c39ff4e08e3ac96e1da32d665be9a5728956012f193
SSDEEP

49152:yO6ftECL3Zdon2+a/EgBqB1y91lxfAV7xWV9MzaNZ8m8Lg1d7RXmVEZvMUn0HjyD:yLftMUSogaEm5hZdIOlEbRaB3YI7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2616	2716	rundll32.exe	30
PID 2716 wrote to memory of 2616	2716	rundll32.exe	30
PID 2716 wrote to memory of 2616	2716	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2716 -s 80
  2⤵
  PID:2616