5552455c5f953e0d18d1eb8a7b3bde5d0d2c795510699e11f863747f9964313c | Triage

Analysis

max time kernel
448s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

vulkan-1.dll
Size

629KB
MD5

42c5becaf6da0b09326b1705f3534e30
SHA1

cee9a37284d9cbcd6738f054a15ee038a573e4e2
SHA256

4f61cd9fd526df090eab6fa0510329c4bc9befd87d691eefef0c406ae327a61e
SHA512

c1402be0086ed3afc7ff32b0bd4ebff3c7eb5ac0efefc48733335f129e9e6c1ba75d63d2481e661333dedee8b557ae877270e14ef730580eb9c0763e5ad76f37
SSDEEP

12288:EjkXX+8jPPQ+sPo1p6AiQH/l3i4cdsrIC6NOTXJB6FuBi7uYdN/W8xBiy:EgXXrJHN+KcOjH6buYdVWn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	3344	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 3344	3592	rundll32.exe	81
PID 3592 wrote to memory of 3344	3592	rundll32.exe	81
PID 3592 wrote to memory of 3344	3592	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
  2⤵
  PID:3344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 620
    3⤵
    - Program crash
    PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3344 -ip 3344
1⤵
PID:4424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads