fe6a7c0a2182b291b60041be502a9784554bd2264d48976f17dc5d4904f65ba3 | Triage

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 15:30

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

931KB
MD5

c933c4ef042148e9c164b944c97ee402
SHA1

0e8a803c1cb3bbad4cfb4406070ddeaa9b6df4b1
SHA256

04f62f822a5e78a67dd0918b5c32163f7a06abeb4ef4bf8462e37aa469538a68
SHA512

cbb4fad63409c1d9c9993676cedc62264543b4bdd0e31171ea82d2dc179b606723799b4e5fc247c2960663d77dbc1dff37f05685676f9c6aaa0f9ec3d59b8978
SSDEEP

24576:fYWOq/4Kt/Ku8n387ecbFb6Z5WoDYsHY6g3P0zAk7sh:fY65/M387R56Z5WoDYsHY6g3P0zAk7s

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1296	2984	rundll32.exe	28
PID 2984 wrote to memory of 1296	2984	rundll32.exe	28
PID 2984 wrote to memory of 1296	2984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2984 -s 88
  2⤵
  PID:1296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads