b95bfdd546145dc16df5684b0f808aa993e3f0fa6ac0b9364bd95d589e34a1b7 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-11-2024 17:11

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

5.1MB
MD5

750cbdfb01943e28e08708183ec208b5
SHA1

1bee0cd3d0970834b2a47daf384354f243fd1ee0
SHA256

a6d295dcc3afcb55aa79eac5f896bceb15ccb2b798db3bb076ceeea78073791a
SHA512

dbfdf76f40558ce2f23ca315b8719e283f0f22f46e733f37c2ae237fdafd23cf7962f36547ba1bb2d5b219de11546c3dc06859fac498a7da97df41018c0d80c4
SSDEEP

98304:5aTPSALpajr/PMMPTZTOWvYQ7klZz8Wd4iRk:Elajr/PMMPTZTOWvCJ4Z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2496 wrote to memory of 2472	2496	rundll32.exe	WerFault.exe
PID 2496 wrote to memory of 2472	2496	rundll32.exe	WerFault.exe
PID 2496 wrote to memory of 2472	2496	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2496 -s 80
  2⤵
  PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads