eb21a698101b0781187b0df85ea6683043e36d5e4229dc692b0a2e410c8adc6e | Triage

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 13:16

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

917KB
MD5

71700726c19de427a698771df0305fd9
SHA1

878c75ac6225c269edd26c295489b44cd99bdf31
SHA256

a8c740555266e601857a088ceb9c7c1b07a240fc496ad7f4124c6c7b8a694503
SHA512

cd26f9e050879ba60cbe6acae59d3d424901817775514a018bf23d606ebf52b8b3310bd0bb566dbe8681e4f666c850621ccc699aecede9fe5a827fa76c0e8dce
SSDEEP

24576:7V9nIy2kwpHHPDnCo3A1XpQ66Z5WoDYsHs6g3P0zAk7UG3:vt2zNLnxA1+66Z5WoDYsHs6g3P0zAk73

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2536	2460	rundll32.exe	29
PID 2460 wrote to memory of 2536	2460	rundll32.exe	29
PID 2460 wrote to memory of 2536	2460	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2460 -s 92
  2⤵
  PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads