7ba60c548a30dfd291328ea52c96c5aa5f3eb1beeb71f195802842b645d27a8e

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 05:55

Target

vk_swiftshader.dll
Size

5.1MB
MD5

0a071201e4dd76996e273c81533bfa74
SHA1

5c92c634027692c344a8e74eab8b4d5c3e049497
SHA256

08e34bc25653f9357a4ccf62966d698b7cc6265dc668046a28403ae5786132ee
SHA512

b5de6548c5c743b6f119183fa06aaf67dcd4cdbc3542378ff87916b670ace1e2f4270f6dcaa4caabd01460c638bd02b565267e7bd9617ca92d72187d374bb7d6
SSDEEP

49152:+VZ+czjbPInepnfJxIlWY1ErtDlEYK1OiscZ2m0j4FfVw5V8bhg/Msm26jTmenM4:cZ+aDJkD01VKOOO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2776 wrote to memory of 2788	2776	rundll32.exe	WerFault.exe
PID 2776 wrote to memory of 2788	2776	rundll32.exe	WerFault.exe
PID 2776 wrote to memory of 2788	2776	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2776 -s 84
  2⤵
  PID:2788