3b48e8860bf29ef6191cbe0620d0e60b9014857306b955276f04703feee17300

Analysis

max time kernel
1561s
max time network
1571s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 16:40

Target

vk_swiftshader.dll
Size

4.9MB
MD5

b81fc81f1a68dbf5111e354cded2e27b
SHA1

04381a966723f49a4d9f01e62fca9844dfa81f6e
SHA256

8fe67773a0c11c610115a36b9c101bb4200c9444cec742d134125052bbe929e4
SHA512

1cb6e05a197bebe6dd2bd613ea461b00d067ae57d7b6cd27a1cf09b919e91644764a4145d9d8fe2ff8e1cb7f5af9a39e706ea711412bd8439155c50cec86cfd3
SSDEEP

49152:36h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzc:Kh3aMXoSHfPwksHldLiuNr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2656	2280	rundll32.exe	30
PID 2280 wrote to memory of 2656	2280	rundll32.exe	30
PID 2280 wrote to memory of 2656	2280	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2280 -s 80
  2⤵
  PID:2656