ece6295ffeea79bc7f93d0f484c33e281cf77aecee01d0eed0b90698a20c8728 | Triage

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 08:57

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

5.1MB
MD5

750cbdfb01943e28e08708183ec208b5
SHA1

1bee0cd3d0970834b2a47daf384354f243fd1ee0
SHA256

a6d295dcc3afcb55aa79eac5f896bceb15ccb2b798db3bb076ceeea78073791a
SHA512

dbfdf76f40558ce2f23ca315b8719e283f0f22f46e733f37c2ae237fdafd23cf7962f36547ba1bb2d5b219de11546c3dc06859fac498a7da97df41018c0d80c4
SSDEEP

98304:5aTPSALpajr/PMMPTZTOWvYQ7klZz8Wd4iRk:Elajr/PMMPTZTOWvCJ4Z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2548 wrote to memory of 3020	2548	rundll32.exe	31
PID 2548 wrote to memory of 3020	2548	rundll32.exe	31
PID 2548 wrote to memory of 3020	2548	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2548 -s 80
  2⤵
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads