d1d620a61f00160ea1d9688cbd1a9455f5e77a539f456922abb0ba251fd296e8

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 02:46

Target

vk_swiftshader.dll
Size

4.9MB
MD5

f16c36ae369609497bfd0847889bec63
SHA1

5dca218bf0b2a20d7d027fa10fdb1b8152564fe4
SHA256

4488a958418227fbe6f64898c2f85eefd87fc9e46aea457233b38db8a86e944d
SHA512

9f06f4a318c8a3e2fdccb6d983087184cff37a2b79e0c1e85b3ac8e45695454c4aacb4468593ebbfff64739b0d598ba4d1d9dd94187b1bbd82c1369c62781109
SSDEEP

49152:56h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzZ:sh3aMXoSHfPwksHldLiuNr

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1904	1640	rundll32.exe	30
PID 1640 wrote to memory of 1904	1640	rundll32.exe	30
PID 1640 wrote to memory of 1904	1640	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1640 -s 80
  2⤵
  PID:1904