77c6385d064b1053db2f29e83e6ea83a2c33098b34ae6c4508bf969a97ed7008 | Triage

Analysis

max time kernel
134s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 03:50

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

624KB
MD5

7949e1e84aea85b9e34b68b607a9467e
SHA1

b4dbc6a149c3482b98f246b625917e68b21a7a21
SHA256

3e04a5ad696827a41891bb61befd845004a0d0816832a69f070716c16e621803
SHA512

2c573f47ce99a2bb7396ca954aa066bd641f879c0aa6a78f700b17acdfad6c6e5fddcd50371fdd76571fc47683600e6a7f29559df59b21af831706d1a8369bcf
SSDEEP

12288:KbHuIeVEXjDNOWx4ooMWRE72YcXVgnvVW+2c+xUpmuHrwYuulnRG9:8HuIIcc9RvAdW+D+up5u

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4824	4276	WerFault.exe	96

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4276	3952	rundll32.exe	96
PID 3952 wrote to memory of 4276	3952	rundll32.exe	96
PID 3952 wrote to memory of 4276	3952	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
  2⤵
  PID:4276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 628
    3⤵
    - Program crash
    PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4276 -ip 4276
1⤵
PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads