79ae38d3832ab7d48543039eff6078538465eb83d8fbb124db2e319295ab5e68 | Triage

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 12:04

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

715KB
MD5

16cd9deb27a902f758d72f5fe3bfa94a
SHA1

b5209cf5493b1c7f93ee4cafea5586ae7ca3aa93
SHA256

a2c6fc4251700f4e5129d5363df8c69a43dff6d46dad61d76b9e75209eeab11a
SHA512

82a31cb2a93bd1fe317ef7a7d15b61ad02dfd636629f1e156e6b0ae81218218a1184d83512f0b549b1baae32c7845b7265b5b69094bb12c90cd2bb61a1a34570
SSDEEP

12288:5+Ru04Y7t/DlHZkyHQiKy99o1d+aXbF9r8PIoILdWG:5f1YZ/fkywby9m1IaXj8A9

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 1940	2492	rundll32.exe	28
PID 2492 wrote to memory of 1940	2492	rundll32.exe	28
PID 2492 wrote to memory of 1940	2492	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2492 -s 92
  2⤵
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads