809f6517480548b9976840145ff402d2598cdf6cc7bc210646306957ca41032e

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/09/2024, 14:12

Target
vk_swiftshader.dll
Size 4.3MB
Sample240917-rhvdvsxand
SHA256 1673f46a96ac36914674cab12c1aaabcb3ef428d8d974480f1dc5661531beea6
MD5 a01021571f60189cfcf6771571bf88f4
SHA1 bf650836892af16a82e5770e8c873acb6ea31308
SHA512 c13aef707bee712ec5069b4af3e8fb8f4cf86ef186aa40c51a467d5aafa4fd571beeae67c5d388b889a959a1a2bff65551eb29f6626f192cf13456026f2c41d2
SSDEEP 49152:TLdyrnUcaL6ge7cxxdPT6B9+29TNj4Vrt/+2AVRJNewGl8HIq98B/lCt1SKUwFyu:yF/h2AVOFmL1KdXpa1s
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1712	2332	rundll32.exe	31
PID 2332 wrote to memory of 1712	2332	rundll32.exe	31
PID 2332 wrote to memory of 1712	2332	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2332 -s 80
  2⤵
  PID:1712