1bca3713ce29b2515d57f04fa578dd48376645844895f4e7c66c0d6e7c95da86 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 22:09

Sharing

Report Analysis Logs

General

Target

Codex/vulkan-1.dll
Size

715KB
MD5

9663210f63cbf7a8d6b36a95d93dd119
SHA1

0fc5c50984b2c9677b8ebce4d4518c1322ce4145
SHA256

de7d4c0e859be24c5ae60b5dad2bbac62cb3b3812ab747ee73f4483c7a10dc88
SHA512

a161dfbb6e40aebec9f33bda4c81f52f456731d76bd48edc1425a2593c75591d969d3a3394a105eae386902ec822de3f9099cd07964f96d4e204f3f0ff48e631
SSDEEP

12288:x+Ru04Y7t/DlHZkyHQiKy99o1d+aXbF9r8PIoICdWG:xf1YZ/fkywby9m1IaXj8Ao

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2804 wrote to memory of 2036	2804	rundll32.exe	WerFault.exe
PID 2804 wrote to memory of 2036	2804	rundll32.exe	WerFault.exe
PID 2804 wrote to memory of 2036	2804	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Codex\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2804 -s 92
2⤵
PID:2036

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...