2ae166f7a476be2f7e635be4972a151d591319798105b4ab7153898bbd025cbe | Triage

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 01:27

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

5.1MB
MD5

524b0d85d992f86a7f26c162f3dbb91c
SHA1

bc9c862fd01f6134a0514dcb63f9fab7a61ce269
SHA256

5b2ffb78fa963f2dea5a7fcf7676fc3aba243c4372d7528c8f1fc8f726d0a3fa
SHA512

422a18af294d7551224e05f5f4f5dcfa51b3455c2e61fc285fd2b95b50274eb77ff317647e17b0e7d47459b4fed19c7c88c90e0878f2269a78d598b1196401d8
SSDEEP

98304:RKJSTu+985EkjstvgsnpkkHF3y/AFIB7:RQq85EkjstvgsnpkkJETB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 3008	2968	rundll32.exe	30
PID 2968 wrote to memory of 3008	2968	rundll32.exe	30
PID 2968 wrote to memory of 3008	2968	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2968 -s 80
  2⤵
  PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads