b693819185ea1a8f6b3cc03297eaf188553f7aaa455644c8341271fb104e4301

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 03:47

Target
vulkan-1.dll
Size 604KB
Sample240511-ecm2daed35
SHA256 368497d1e1f14779a5b62d0d83c7e4b843433d229ab65c0e7b167c726e574d5a
MD5 4d8346cbdb86a40d5cee1c78e6eaabc7
SHA1 23ea9ca9770dceb410ccb66cc572452459e09e51
SHA512 c1b5aec432efc3ed9fb5ed0c33e3e6dd579fbafe8824dd559f2a0b6ec0428b318e0c4e241d6d15ce5705e9fb57e8ef49f0acbfd13deb6d8ae0616ba837e9481c
SSDEEP 12288:t/gHsdW7JQtGide9H++esx5R+LpwPk7d5A5q2el1R5MuPvuNlsO:ZgHsdWIde9H+ch+LpwYUo2ebb4W
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4656	4236	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4236	4436	rundll32.exe	80
PID 4436 wrote to memory of 4236	4436	rundll32.exe	80
PID 4436 wrote to memory of 4236	4436	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
  2⤵
  PID:4236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 612
    3⤵
    - Program crash
    PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4236 -ip 4236
1⤵
PID:3092