18ce929380ab15f9e9d23d156ff3cff56b94e33641a40379f57e7adc91130c3f | Triage

Resubmissions

09/04/2024, 22:11

240409-131wtaea38 8

09/04/2024, 21:43

240409-1k5r2scg65 7

09/04/2024, 21:18

240409-z5mxasbe59 7

06/04/2024, 10:55

240406-mz7nashc59 8

06/04/2024, 10:41

240406-mrjaqsgd6z 7

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 21:18

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

858KB
MD5

1fa7e2a7de659abf98500dad8a8559d9
SHA1

e915365296802e1a2556d5b4bc12673e5d98e5e4
SHA256

eb4ed249c3fba6607dccadb24e96f336dfb6106984d1e7b3c49aa00e9dbbb0dd
SHA512

3f93b5495a3247dc9fd760a77d06b952f6cf1217749d9715ab3ecc4ed8816604b535332dd79d89cfa6cfd2c1abffa6a20c5c447e85c078870ccd4fd46d659dcf
SSDEEP

12288:xefVW1lX8MvG9E0wsYox2Nmp6yWEaAT6bJUQzH3To+vAEir1iS:xOcTX8p20wsYHmXaATmXj2F

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28
PID 2876 wrote to memory of 2904	2876	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 88
  2⤵
  PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads