69d3b8a2b9bf9fe4e1be8a17edcf3bf19379aa27c53a73853585b832a8babe5b | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 02:27

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

830KB
MD5

4794c60a34d5bfc6e6d65d6d0cfb575b
SHA1

e8a5925ddde1f300927d0b474b8741161a433701
SHA256

79601e7917850f7fde72b2f2785cd0daacd2fe68aa0cfb4050dd01988794e5e1
SHA512

6bb94d7e1362884291099bd6370e7eebad47d2b60bc18cbe597afe02f8bec350c043a03c13eb64adf291c2a993b18a37a637758f1385736ae772467259ecdebf
SSDEEP

12288:519hqUpfVn/HBSu5Eg14Jegb6m3vKzE/6oFXBQoEp7:r9hqCx5EgG6mSzNUTEp

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2956	1224	rundll32.exe	28
PID 1224 wrote to memory of 2956	1224	rundll32.exe	28
PID 1224 wrote to memory of 2956	1224	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1224 -s 88
  2⤵
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads