0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149 | Triage

Analysis

max time kernel
118s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 21:10

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

819KB
MD5

ad4a5dcf631afd553b4fed8a269c7897
SHA1

f1bded0b28ee8aed4a52a6d19d871eba4828e0f2
SHA256

3141825bfa3a8cecf8b59767e8b6ac41c20685932d6000b9c6cd0e40ddca12db
SHA512

8e01379201f2a907cff7f32dfbac6b1eb8ee014312755884b35e4065477d8a8069e3188086d7cced11d437b461211bca6abb6e582e98473883cf35faad41eae2
SSDEEP

12288:4kyJJLfcn5To6PuXtLvEdGnZSss43uobpoD:fnhoR5Ed8S2uTD

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2492 wrote to memory of 2148	2492	rundll32.exe	28
PID 2492 wrote to memory of 2148	2492	rundll32.exe	28
PID 2492 wrote to memory of 2148	2492	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2492 -s 92
  2⤵
  PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads