7bb922f34437a2358f5eaa01d7f6c04dc2194e22e3e84f62ac8e5066defd2c38 | Triage

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 02:58

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

931KB
MD5

678f12a18eacfaa12f58dbdc07837715
SHA1

219730f5af17ccf252fb4f3e64ad00f650c693f5
SHA256

af1634ce8221a19dbe09f2713875478cfb12f5bbe5d10763c3c905f608489e49
SHA512

c125f2ca6a7375754512dfdf8e2cd71f8c686fec627cf3006d9093f0c0999004b60cfb3ae025fe2fad6be89346c6e7531b8dee6da9b74a86841fe68c05495036
SSDEEP

24576:lYWOq/4Kt/Ku8n3W7ecbFb6Z5WoDYsHY6g3P0zAk7sH:lY65/M3W7R56Z5WoDYsHY6g3P0zAk7s

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2680	2996	rundll32.exe	28
PID 2996 wrote to memory of 2680	2996	rundll32.exe	28
PID 2996 wrote to memory of 2680	2996	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2996 -s 104
  2⤵
  PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads