bda512b2e0b17d5222586854c8d87566feec49798e6a4a7c7664a4ac737c93f8

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 01:53

Target

vk_swiftshader.dll
Size

4.9MB
MD5

0b0658bf4f8cf397e1deddc50d67523f
SHA1

8fcf0726ee1272a3d5c65d50be1626f1b1f49477
SHA256

94adcd97d1cdd459d21f0b5b57e0caf4c5c6e44f7bc6fc6a73f0bd133e8d551e
SHA512

d745424644b66783dc8cf6dd043f27356f25afcda679ed43672fc0caf33c7339006f033e0fb392c865a5eb3e9f0e5edf37154e77121ba5a71893420da26b7cd5
SSDEEP

49152:26h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzw:Xh3aMXoSHfPwksHldLiuNr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2112	1964	rundll32.exe	29
PID 1964 wrote to memory of 2112	1964	rundll32.exe	29
PID 1964 wrote to memory of 2112	1964	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1964 -s 84
  2⤵
  PID:2112