640a873a9bdc77ddd340a9196fece62dcbfd3e6bdeec787f60d882a59a4ca264 | Triage

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 05:23

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

4.3MB
MD5

77f7b4f46cb3e06b53729fd1e562dfef
SHA1

223c09805220ff2b5c1dcbdd5c0396231ea34f11
SHA256

a648cd4671b12b469c4d2de20c2ba2429c9388c0f9d4b3d9d2244853d0e5acb5
SHA512

6be9afda9320074c5842419cf8493d715ca65a3362d368d3a35e35a47d36f8197b0f19877485b41a06e21148613a77bb6275b0586c4a38da8a25efe6b5a6b571
SSDEEP

49152:ImuXbIxohwCWtm32rw3lYIDkhUw2B2w/XBnbtZNDNHI6iBewVqlnrSrMrXHYtvQi:Ca9dCeKOB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1968	2276	rundll32.exe	28
PID 2276 wrote to memory of 1968	2276	rundll32.exe	28
PID 2276 wrote to memory of 1968	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2276 -s 80
  2⤵
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads