89f90ef40f2f4f27624de3e884d236b56c211b5d6a07eeb3f2ab95437ec7b633 | Triage

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/01/2024, 22:54

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

858KB
MD5

76ad266333e1c7f6ba11818fab5196ba
SHA1

fea39f5ac85b4067074f9cee8e4638480d04708e
SHA256

21ea31d7d8e035f60a529d53c9eb11ae2eff0ae7d2f5cad7169fac73b54d5951
SHA512

217f48142b87311d573fb7457bb12a637c099ef99a281a27dcb9d5d2b7cd385737b204d421e1f94ea1ee7f4a24a1fe39d8d4393531ac1bb8b0456a46b94d59c8
SSDEEP

12288:WefVW1lX8MvG9E0wsYox2Nmp6yWEaAT6bJUQzH3To+4AEir1iS:WOcTX8p20wsYHmXaATmXjvF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2220	2984	rundll32.exe	16
PID 2984 wrote to memory of 2220	2984	rundll32.exe	16
PID 2984 wrote to memory of 2220	2984	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2984 -s 88
  2⤵
  PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads