591dc8a28bd81fef1f812f6a2bcd573770f99df40f10b7b1396ddc0e62e24631

Analysis

max time kernel
10s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 09:07

Target

vk_swiftshader.dll
Size

4.9MB
MD5

e020802e3d7f666f3dcaa6ad4e099698
SHA1

46d4993905a76872ebdc191565456f90862d581b
SHA256

fd0e0a3a02b0b9d19c390909634e3ff241d0fafa4c9fc85c94f39c3a6e09e8c0
SHA512

c342ff5adb885cc387c7a98eff8c3e3557fc33e96650310fb46b5baf70299a381aaf00faa5302a21381bfe72f3caeb542e47409b81181cda8f3f63fd27caa265
SSDEEP

49152:06h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzm:9h3aMXoSHfPwksHldLiuNr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 2520	1084	rundll32.exe	29
PID 1084 wrote to memory of 2520	1084	rundll32.exe	29
PID 1084 wrote to memory of 2520	1084	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1084 -s 80
  2⤵
  PID:2520