d7e4f8af935f52cbbcd311c07ec66b2ec5c7d5952dbf7b8e1414ff6795b7527f

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/01/2025, 19:12

Target

swiftshader/chrome.dll
Size

159.9MB
MD5

15f177ea56f074638a0c271d0695cf0f
SHA1

b9c7ee1e59711787de4f78dc764d5bac2c10922d
SHA256

c604619e34f1d527393f1526cee58e0bc5f3a254a962c5952e9f143dd4c9ed1c
SHA512

71d1b40bec51ef11f7b5a7e849ac60b0a222a49a89c51b4d4fabd110a33966991538b606decf8a2caaf595f1e527b3431dfced6d45ac3463aabc637559f3bc29
SSDEEP

786432:vu1y2Qbz4/annWUlKTZii+0rkwLyEW6YJ+OwjaaIZYGJgZoX92oFm1Pl5XZL0AEM:gMb0GWUkZixsbyEWV+j7LbZokTXZLz

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\debug.log	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2320	2604	rundll32.exe	29
PID 2604 wrote to memory of 2320	2604	rundll32.exe	29
PID 2604 wrote to memory of 2320	2604	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\chrome.dll,#1
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2604 -s 276
  2⤵
  PID:2320