809f6517480548b9976840145ff402d2598cdf6cc7bc210646306957ca41032e

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-09-2024 13:58

Target

vk_swiftshader.dll
Size

4.3MB
MD5

a01021571f60189cfcf6771571bf88f4
SHA1

bf650836892af16a82e5770e8c873acb6ea31308
SHA256

1673f46a96ac36914674cab12c1aaabcb3ef428d8d974480f1dc5661531beea6
SHA512

c13aef707bee712ec5069b4af3e8fb8f4cf86ef186aa40c51a467d5aafa4fd571beeae67c5d388b889a959a1a2bff65551eb29f6626f192cf13456026f2c41d2
SSDEEP

49152:TLdyrnUcaL6ge7cxxdPT6B9+29TNj4Vrt/+2AVRJNewGl8HIq98B/lCt1SKUwFyu:yF/h2AVOFmL1KdXpa1s

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1116	3024	rundll32.exe	31
PID 3024 wrote to memory of 1116	3024	rundll32.exe	31
PID 3024 wrote to memory of 1116	3024	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3024 -s 80
  2⤵
  PID:1116