ab5268c60129d2e996824459f1837505c828184d08843dee542dc1e9a90db70a | Triage

Analysis

max time kernel
25s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/03/2023, 20:19

Sharing

Report Analysis Logs

General

Target

vulkan.dll
Size

1.0MB
MD5

5fddc0a11a3a43d22cc26006db783a87
SHA1

0e4213ca22dc85d6868c5b737b1ad2fafc9f3abf
SHA256

c918b34d6dcd9d3681655cd5b10b4b4a774a80979e8223e684340c1750568a9a
SHA512

06946507433f48fef41c09935276454f7aa50eafe15cbfcbf70822c96b765fc2e45d6d54801e8dfe0c418f46e3c0db8687dd46c1b1e122a5390c0c8fab46d1c5
SSDEEP

12288:ATI+smXpgdOm3z9g8azb7isdBrkByASSqmgbozFD:AL7cxg8ujrkQAPqm+GD

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	1988	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2000	1988	rundll32.exe	27
PID 1988 wrote to memory of 2000	1988	rundll32.exe	27
PID 1988 wrote to memory of 2000	1988	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1988 -s 92
  2⤵
  - Program crash
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads