30863f7a149c41c3edb9537a1e93321faab3c68fed49cccbaeddb099388b14ac

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 18:05

Target

vk_swiftshader.dll
Size

5.1MB
MD5

d45cc85b4e5763a553f3cffc9f161beb
SHA1

99b06d080a4ecc3a8419eab025181918c43ac87e
SHA256

c9c85b52674ba40d768f752cb3011f41ae676310ae49d4e91f8d877ba747e3db
SHA512

ef4d53c2f6d22569a149cdfcfee00eabd4333a4ca7a88fed32f990225f4e5c5a1c8379d74f4d75a5f715a4c24244b2868fc74e021e0cfcfa11bf53d28d0746d5
SSDEEP

49152:UVZ+czjbPInepnfJxIlWY1ErtDlEYK1OiscZ2m0j4FfVw5V8bhg/Msm26jTmenM4:aZ+aDJkD01VKOOO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2496	2460	rundll32.exe	31
PID 2460 wrote to memory of 2496	2460	rundll32.exe	31
PID 2460 wrote to memory of 2496	2460	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2460 -s 80
  2⤵
  PID:2496