e8784b21f05c7f91ae6082ae912ddefddf62bccf717c2a9f649f147eb28eadbb | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 18:15

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

935KB
MD5

d8bbc2f245dfae4094db4b9ce77bc3af
SHA1

654efbff9894120f6f1030a47a96074c838e88a9
SHA256

56d3cc80ca50f32cedf0a720d6bfc38647566e39630e1907d76e3995e4651492
SHA512

7ba6322b23e987f7908dae01fc277c5573bd85e219afb330fe2de1b7be281febf9908ad21957c0600f2b1d4a7aec7f00e54ec22d59b95ba573a6b077daf7b24f
SSDEEP

24576:zy+lCO+5ian96u6WbEJXay6Z5WdDYsH26g3P0zAk7o3uk:zymViaWbYT6Z5WdDYsH26g3P0zAk7ot

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1780	2088	rundll32.exe	28
PID 2088 wrote to memory of 1780	2088	rundll32.exe	28
PID 2088 wrote to memory of 1780	2088	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2088 -s 88
  2⤵
  PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads