42ad279878792b976f051847fc40e8b31fb4a043cc440455fca28b8f9a252271

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 23:42

Target
vulkan-1.dll
Size 935KB
Sample240603-3p5c7aec79
SHA256 77d0df2de42a77b936c155e701ed6a98a8efa0e7b9dc710f95384da20635aaad
MD5 cc8d44b42069f6fcf2d87cdf5addef0e
SHA1 eae8a663198b991c1f7deeed63b3bfd795e26ac1
SHA512 5db36695451a484debb276597d0d5d1b5a532b26324026f34ca7ef7b2aa958a228ecfc104b759d9a1a09bc64ead00935b5c73089d0e4d183ea94ae4fcca61bad
SSDEEP 24576:Yy+lCO+5ian96u6WbEJXay6Z5WdDYsH26g3P0zAk7o3uv:YymViaWbYT6Z5WdDYsH26g3P0zAk7ou
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1968	2256	rundll32.exe	28
PID 2256 wrote to memory of 1968	2256	rundll32.exe	28
PID 2256 wrote to memory of 1968	2256	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2256 -s 88
  2⤵
  PID:1968