90fd17cf8603ce14ef8e537d020bbe360bd1f856028da7cff94abbc76203a7ff

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 15:03

Target
vulkan-1.dll
Size 899KB
Sample240608-se57macf91
SHA256 4ee4532ec52c5fec359c36d7e2576cc13060e2499659aedddf26f9f45c2ebc7f
MD5 e1b68a105072fc5aa7e06c73b5a310f4
SHA1 466674e56c09aefbba20d6c4c93b4e2a6a40a79f
SHA512 8b4e8f4ac7f5d84c0427c8c01e679f93de197ad0ff5868e8a9d35566feaa6e23c8524d380f659358de843f49e22036250de6581d27870fa9ad519d8d97ff5d6e
SSDEEP 24576:bR9nl1crwjLAQw6Z5WUDYsH56g3P0zAk7:bR1l1culw6Z5WUDYsH56g3P0zAk7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1640	1004	rundll32.exe	28
PID 1004 wrote to memory of 1640	1004	rundll32.exe	28
PID 1004 wrote to memory of 1640	1004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1004 -s 88
  2⤵
  PID:1640