f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7 | Triage

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 00:22

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

906KB
MD5

8439213fbb22a848ce814982d502bdc4
SHA1

6c5831de36a539c0689410b00f1b8aa1dc6f7c2d
SHA256

e69f794109b12523de314a471c56278cd921be58facbd18ec351685d15894cc0
SHA512

e4e570e5b98420d99634167e0d9f920cba27fc4b8e91c70cc4e5b33a4b3299a69ce9b294aae538aeb150135378978a6c7b0644a645b797ab230e185593c828c0
SSDEEP

24576:6GZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk78:OwwvuziiV/iXxc6Z5WODYsHh6g3P0zAu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2012	1724	rundll32.exe	28
PID 1724 wrote to memory of 2012	1724	rundll32.exe	28
PID 1724 wrote to memory of 2012	1724	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1724 -s 88
  2⤵
  PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads