7ba60c548a30dfd291328ea52c96c5aa5f3eb1beeb71f195802842b645d27a8e

Analysis

max time kernel
86s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:25

Target

vk_swiftshader.dll
Size

5.1MB
MD5

0a071201e4dd76996e273c81533bfa74
SHA1

5c92c634027692c344a8e74eab8b4d5c3e049497
SHA256

08e34bc25653f9357a4ccf62966d698b7cc6265dc668046a28403ae5786132ee
SHA512

b5de6548c5c743b6f119183fa06aaf67dcd4cdbc3542378ff87916b670ace1e2f4270f6dcaa4caabd01460c638bd02b565267e7bd9617ca92d72187d374bb7d6
SSDEEP

49152:+VZ+czjbPInepnfJxIlWY1ErtDlEYK1OiscZ2m0j4FfVw5V8bhg/Msm26jTmenM4:cZ+aDJkD01VKOOO

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1232	1112	rundll32.exe	30
PID 1112 wrote to memory of 1232	1112	rundll32.exe	30
PID 1112 wrote to memory of 1232	1112	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1112 -s 80
  2⤵
  PID:1232