08a49e628cb398f2bc902e09bb6ad42bfc97ce09aca0aa3ae359a17e7c432b64

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 01:03

Target

vk_swiftshader.dll
Size

4.3MB
MD5

a01021571f60189cfcf6771571bf88f4
SHA1

bf650836892af16a82e5770e8c873acb6ea31308
SHA256

1673f46a96ac36914674cab12c1aaabcb3ef428d8d974480f1dc5661531beea6
SHA512

c13aef707bee712ec5069b4af3e8fb8f4cf86ef186aa40c51a467d5aafa4fd571beeae67c5d388b889a959a1a2bff65551eb29f6626f192cf13456026f2c41d2
SSDEEP

49152:TLdyrnUcaL6ge7cxxdPT6B9+29TNj4Vrt/+2AVRJNewGl8HIq98B/lCt1SKUwFyu:yF/h2AVOFmL1KdXpa1s

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2560	2656	rundll32.exe	30
PID 2656 wrote to memory of 2560	2656	rundll32.exe	30
PID 2656 wrote to memory of 2560	2656	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2656 -s 84
  2⤵
  PID:2560