eadcf660e731fd3de0a5a8bee2f2337e7d78438f4e9293d2c90d5e63a2d9368e | Triage

Resubmissions

26-07-2024 08:19

240726-j7ytkszeqd 3

07-05-2024 20:40

240507-zgaxtseg4v 10

23-04-2024 21:09

240423-zzq2rsca28 7

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 21:09

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

917KB
MD5

5e162bcda79c966d63a15e49c8bf8c13
SHA1

2f2c77e120b66a34648c22fa23d525b1ead0df67
SHA256

25d6b4ef0a74f1a04476dc2944def16d4ca2b015277add2ebcfbc1c3df13793c
SHA512

10a89f1618b9aa96fd524f92b29506045cac8f00ee846e950591d59f6fb49a79268044424e2497e3c75815c140a458c9fb27e781a2fe1949f5eed408abe3326d
SSDEEP

24576:WV9nIy2kwpHHPDnCo3A1XpQ66Z5WoDYsHs6g3P0zAk7IG3:it2zNLnxA1+66Z5WoDYsHs6g3P0zAk7z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1936 wrote to memory of 2356	1936	rundll32.exe	WerFault.exe
PID 1936 wrote to memory of 2356	1936	rundll32.exe	WerFault.exe
PID 1936 wrote to memory of 2356	1936	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1936 -s 92
2⤵
PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads