87e1140039cf26463f5d7903e8f3f097533ff64591b8756ba8cb28094729013b

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 14:29

Target
vulkan-1.dll
Size 715KB
Sample240608-rtqvtadd26
SHA256 37ee8858cada6db0e511d083ba0729282b004b7e239966521300955ad8b1b18a
MD5 67ebd2114a9c3a1b2ce2635f21e100e8
SHA1 15a8315b28dca9d7b5c1f604882050714f130718
SHA512 6578d098b657ba4b28da60f338e033f5622e2fa9473d1833af85a44b314c1d662fcf12120dc466c7c19fcd5901b012f1f8ae7c9ce65ff8155ecd68714f25e102
SSDEEP 12288:QDSRRxZS8ZkDVQ0FQNNTlSdBHxEXdgzXosoIjspf:QDSZZSe2Q0FOTleadgLP2f
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2984	1752	rundll32.exe	28
PID 1752 wrote to memory of 2984	1752	rundll32.exe	28
PID 1752 wrote to memory of 2984	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1752 -s 92
  2⤵
  PID:2984