c10f2ab79dadfe62b64ccdeff45a158c0b51541b51f38711a72f716eba746a06

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 23:00

Target
vulkan-1.dll
Size 933KB
Sample240519-2y95csfg38
SHA256 a73ef0a1dc0578cf64e856dc9461ba135bd742f3d5f60713e4d645e17533e9c9
MD5 e43b12cf3c7a21a5c50d3c7b4f88ab04
SHA1 79664cf6cfb23c3e78361f817bac1440e6c7fe41
SHA512 656841544adf4fac2abde64bd62bc9392e76178797e81f73a13af05f84e6f51ad83aba1320a2af17e910bc3eb35c40ef9ba386f36ebd443ac04acefc10dc0248
SSDEEP 24576:57SR7TmAl/bFPmGDsfNy6Z5WiDYsH56g3P0zAk7LZIOayz:57A/bFPmH86Z5WiDYsH56g3P0zAk7LE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2940	2388	rundll32.exe	28
PID 2388 wrote to memory of 2940	2388	rundll32.exe	28
PID 2388 wrote to memory of 2940	2388	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2388 -s 88
  2⤵
  PID:2940