aaf4f6122104edac1ce7fdfd273a3267765a2c615e64998c8cb4d80f386a4abe

Analysis

max time kernel
8s
max time network
19s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 21:16

Target

vk_swiftshader.dll
Size

4.9MB
MD5

0b0658bf4f8cf397e1deddc50d67523f
SHA1

8fcf0726ee1272a3d5c65d50be1626f1b1f49477
SHA256

94adcd97d1cdd459d21f0b5b57e0caf4c5c6e44f7bc6fc6a73f0bd133e8d551e
SHA512

d745424644b66783dc8cf6dd043f27356f25afcda679ed43672fc0caf33c7339006f033e0fb392c865a5eb3e9f0e5edf37154e77121ba5a71893420da26b7cd5
SSDEEP

49152:26h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzw:Xh3aMXoSHfPwksHldLiuNr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1976	1496	rundll32.exe	30
PID 1496 wrote to memory of 1976	1496	rundll32.exe	30
PID 1496 wrote to memory of 1976	1496	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1496 -s 80
  2⤵
  PID:1976