f006540a62bc79c36f241ecb5b1c114e6933300e3d6b09e35e014660914bd845 | Triage

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 14:14

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

715KB
MD5

67ebd2114a9c3a1b2ce2635f21e100e8
SHA1

15a8315b28dca9d7b5c1f604882050714f130718
SHA256

37ee8858cada6db0e511d083ba0729282b004b7e239966521300955ad8b1b18a
SHA512

6578d098b657ba4b28da60f338e033f5622e2fa9473d1833af85a44b314c1d662fcf12120dc466c7c19fcd5901b012f1f8ae7c9ce65ff8155ecd68714f25e102
SSDEEP

12288:QDSRRxZS8ZkDVQ0FQNNTlSdBHxEXdgzXosoIjspf:QDSZZSe2Q0FOTleadgLP2f

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1936	2132	rundll32.exe	28
PID 2132 wrote to memory of 1936	2132	rundll32.exe	28
PID 2132 wrote to memory of 1936	2132	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2132 -s 88
  2⤵
  PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads