679392445dca5cc2c6efebd287ccc3eb354eab142972fe829b7511bafd08a3ad | Triage

Analysis

max time kernel
1563s
max time network
1580s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 02:36

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

819KB
MD5

b91586bd80e057a7f62bdc4422744812
SHA1

a1df644421ece2e740e5bf0ed98b4f269fd85c39
SHA256

8ba72d98e0f78b77bda7816cd7232809d287310d34e0f1d7472b9d5fda2c6d02
SHA512

94f0a8e3e75e4803891c0fcb257052dbe0e7399772fc7a46ab802629f76ee580ed30b3678fa6bc3744c12cf9f3103bbc8276e88f6711278748148e9fbeef2053
SSDEEP

12288:ekyJJLfcn5To6PuXtLvEdGnZSss43uobIoD:JnhoR5Ed8S2ukD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2356	2760	rundll32.exe	28
PID 2760 wrote to memory of 2356	2760	rundll32.exe	28
PID 2760 wrote to memory of 2356	2760	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2760 -s 92
  2⤵
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads