30091faafd62ea7ba9868db2ee575dab98fd126a78d39590f57ea7b38b20d966

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 16:29

Target

vk_swiftshader.dll
Size

5.1MB
MD5

0a071201e4dd76996e273c81533bfa74
SHA1

5c92c634027692c344a8e74eab8b4d5c3e049497
SHA256

08e34bc25653f9357a4ccf62966d698b7cc6265dc668046a28403ae5786132ee
SHA512

b5de6548c5c743b6f119183fa06aaf67dcd4cdbc3542378ff87916b670ace1e2f4270f6dcaa4caabd01460c638bd02b565267e7bd9617ca92d72187d374bb7d6
SSDEEP

49152:+VZ+czjbPInepnfJxIlWY1ErtDlEYK1OiscZ2m0j4FfVw5V8bhg/Msm26jTmenM4:cZ+aDJkD01VKOOO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2856 wrote to memory of 3000	2856	rundll32.exe	WerFault.exe
PID 2856 wrote to memory of 3000	2856	rundll32.exe	WerFault.exe
PID 2856 wrote to memory of 3000	2856	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2856 -s 80
  2⤵
  PID:3000