e862a4c024eb9c3df7442591bbf0700a3bb2b498fa80bc99296e9fb33defd120

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 12:57

Target
vulkan-1.dll
Size 858KB
Sample240119-p6yebaedel
SHA256 21ea31d7d8e035f60a529d53c9eb11ae2eff0ae7d2f5cad7169fac73b54d5951
MD5 76ad266333e1c7f6ba11818fab5196ba
SHA1 fea39f5ac85b4067074f9cee8e4638480d04708e
SHA512 217f48142b87311d573fb7457bb12a637c099ef99a281a27dcb9d5d2b7cd385737b204d421e1f94ea1ee7f4a24a1fe39d8d4393531ac1bb8b0456a46b94d59c8
SSDEEP 12288:WefVW1lX8MvG9E0wsYox2Nmp6yWEaAT6bJUQzH3To+4AEir1iS:WOcTX8p20wsYHmXaATmXjvF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2292	1416	rundll32.exe	16
PID 1416 wrote to memory of 2292	1416	rundll32.exe	16
PID 1416 wrote to memory of 2292	1416	rundll32.exe	16

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1416 -s 88
1⤵
PID:2292

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416