a2d4c19d2a8c9a6a196ebcf1f49a6eed03b06b76880d772fa8c0ab72aec59763 | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 20:48

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

854KB
MD5

acc5484ae9cfff351ffc0341fae483dc
SHA1

616b6e2763a9e4ac5f1c959ebdc4d15b68ac0d7c
SHA256

1c7fe50af9f2c7722274ee55c28bc1e786effbed15943909d8da8f3492275574
SHA512

25a47e2e7947f358f993fee1bd564c4e5df8db1f72ba7fb376b5aed0e671fc024e1b9d47754a78cac90082a84debb0eaef772e91f8121a2d6f35a5df41cb8fe1
SSDEEP

12288:xPcsZ/i18O9zheQQZ7bjnfjaimmVBmJUAI0/bf1IohgX6G6:xPcL19F0QCn5VBKQmSL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2036 wrote to memory of 2136	2036	rundll32.exe	28
PID 2036 wrote to memory of 2136	2036	rundll32.exe	28
PID 2036 wrote to memory of 2136	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2036 -s 88
  2⤵
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads