c48d81efa3d480934e01a455bb3d8ec42405eea940aa4fb0d1e976a1532f53ce | Triage

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 23:28

Sharing

Report Analysis Logs

General

Target

vk_swiftshader.dll
Size

5.1MB
MD5

750cbdfb01943e28e08708183ec208b5
SHA1

1bee0cd3d0970834b2a47daf384354f243fd1ee0
SHA256

a6d295dcc3afcb55aa79eac5f896bceb15ccb2b798db3bb076ceeea78073791a
SHA512

dbfdf76f40558ce2f23ca315b8719e283f0f22f46e733f37c2ae237fdafd23cf7962f36547ba1bb2d5b219de11546c3dc06859fac498a7da97df41018c0d80c4
SSDEEP

98304:5aTPSALpajr/PMMPTZTOWvYQ7klZz8Wd4iRk:Elajr/PMMPTZTOWvCJ4Z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2872 wrote to memory of 2908	2872	rundll32.exe	28
PID 2872 wrote to memory of 2908	2872	rundll32.exe	28
PID 2872 wrote to memory of 2908	2872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2872 -s 80
  2⤵
  PID:2908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads