c954ba4d9f8e230d8fd42b5fa0bd25bd978725b78b9473e23da4740cda0606c1

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 02:59

Target
vulkan-1.dll
Size 624KB
Sample240613-dg5asasbpc
SHA256 3e04a5ad696827a41891bb61befd845004a0d0816832a69f070716c16e621803
MD5 7949e1e84aea85b9e34b68b607a9467e
SHA1 b4dbc6a149c3482b98f246b625917e68b21a7a21
SHA512 2c573f47ce99a2bb7396ca954aa066bd641f879c0aa6a78f700b17acdfad6c6e5fddcd50371fdd76571fc47683600e6a7f29559df59b21af831706d1a8369bcf
SSDEEP 12288:KbHuIeVEXjDNOWx4ooMWRE72YcXVgnvVW+2c+xUpmuHrwYuulnRG9:8HuIIcc9RvAdW+D+up5u
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
792	1676	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1676	2344	rundll32.exe	28
PID 2344 wrote to memory of 1676	2344	rundll32.exe	28
PID 2344 wrote to memory of 1676	2344	rundll32.exe	28
PID 2344 wrote to memory of 1676	2344	rundll32.exe	28
PID 2344 wrote to memory of 1676	2344	rundll32.exe	28
PID 2344 wrote to memory of 1676	2344	rundll32.exe	28
PID 2344 wrote to memory of 1676	2344	rundll32.exe	28
PID 1676 wrote to memory of 792	1676	rundll32.exe	29
PID 1676 wrote to memory of 792	1676	rundll32.exe	29
PID 1676 wrote to memory of 792	1676	rundll32.exe	29
PID 1676 wrote to memory of 792	1676	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 220
    3⤵
    - Program crash
    PID:792