6bb390bddaaff3e75a6a2b1ecafa3f49bf6e4d93747302a6870698fb26285a32 | Triage

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 20:50

Sharing

Report Analysis Logs

General

Target

MiLoginTool/vulkan-1.dll
Size

700KB
MD5

c0100648bfa19939d20d9ffcb75a3778
SHA1

3c5ee2e7a354b1b320cb8532e85c298dedd9a218
SHA256

7961b5e312ae6cd21c0bec5d71eeb271df33d376a57cb0c60599e6e63a797cd2
SHA512

42d3ec4cba975123d3c38db646be1a81770468b67ad5f6dad46cf2194824e58f8bd7e9cd82d95f815ef6fa4c52c61dc7447f2202bfe930f6d2612344386c74d9
SSDEEP

12288:R3PPkUGjjALrjfW4IMZg9uwIP85ShK6KfCXounxCsikGSdM:R3PMU8jA/jfW4nZe6K66i

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
980	5048	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 5048	1724	rundll32.exe	87
PID 1724 wrote to memory of 5048	1724	rundll32.exe	87
PID 1724 wrote to memory of 5048	1724	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MiLoginTool\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MiLoginTool\vulkan-1.dll,#1
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 620
    3⤵
    - Program crash
    PID:980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5048 -ip 5048
1⤵
PID:1852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads