30091faafd62ea7ba9868db2ee575dab98fd126a78d39590f57ea7b38b20d966

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-09-2024 19:09

Target

vk_swiftshader.dll
Size

5.1MB
MD5

0a071201e4dd76996e273c81533bfa74
SHA1

5c92c634027692c344a8e74eab8b4d5c3e049497
SHA256

08e34bc25653f9357a4ccf62966d698b7cc6265dc668046a28403ae5786132ee
SHA512

b5de6548c5c743b6f119183fa06aaf67dcd4cdbc3542378ff87916b670ace1e2f4270f6dcaa4caabd01460c638bd02b565267e7bd9617ca92d72187d374bb7d6
SSDEEP

49152:+VZ+czjbPInepnfJxIlWY1ErtDlEYK1OiscZ2m0j4FfVw5V8bhg/Msm26jTmenM4:cZ+aDJkD01VKOOO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1784	2680	rundll32.exe	30
PID 2680 wrote to memory of 1784	2680	rundll32.exe	30
PID 2680 wrote to memory of 1784	2680	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2680 -s 80
  2⤵
  PID:1784