1ee419e2105be9bf3c451bf29522f456eaebebd96865bdc1c3aff76c3a0caf59

Analysis

max time kernel
11s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 17:17

Target

vk_swiftshader.dll
Size

5.1MB
MD5

0a071201e4dd76996e273c81533bfa74
SHA1

5c92c634027692c344a8e74eab8b4d5c3e049497
SHA256

08e34bc25653f9357a4ccf62966d698b7cc6265dc668046a28403ae5786132ee
SHA512

b5de6548c5c743b6f119183fa06aaf67dcd4cdbc3542378ff87916b670ace1e2f4270f6dcaa4caabd01460c638bd02b565267e7bd9617ca92d72187d374bb7d6
SSDEEP

49152:+VZ+czjbPInepnfJxIlWY1ErtDlEYK1OiscZ2m0j4FfVw5V8bhg/Msm26jTmenM4:cZ+aDJkD01VKOOO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1660 wrote to memory of 1320	1660	rundll32.exe	WerFault.exe
PID 1660 wrote to memory of 1320	1660	rundll32.exe	WerFault.exe
PID 1660 wrote to memory of 1320	1660	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1660 -s 80
  2⤵
  PID:1320