a4c5f72184b8bb06b6202074d1c81469ea56f74dace70d09fb5c798f85d8b700 | Triage

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 11:53

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

931KB
MD5

0a8150e85160ea4311ddbd5b2d1b0b1b
SHA1

a012b8886ec9f305ff4a055ccddd5fc1f6045869
SHA256

0d56a41bead58fd5fee44b2ee60485d4c80a3a639acc42cfc57c8e059078dfe0
SHA512

d2d853d072ae7ac6871c880f164eeaa6300d9f951de3aacb4d65195407aa4a1ef18b9beae14b7eda0936e4fca5fb56b65038370d8e349893f3c8027526415921
SSDEEP

24576:xYWOq/4Kt/Ku8n387ecbFb6Z5WoDYsHY6g3P0zAk7so:xY65/M387R56Z5WoDYsHY6g3P0zAk7s

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2184	1520	rundll32.exe	28
PID 1520 wrote to memory of 2184	1520	rundll32.exe	28
PID 1520 wrote to memory of 2184	1520	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1520 -s 104
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads