3374d19f61bf83de14f2799b867fc4ee1a262bde023c34f761e1f379c29eb2ed | Triage

Analysis

max time kernel
21s
max time network
20s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 16:57

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

906KB
MD5

f52a1bf8f932e1e7ddf054110acd3801
SHA1

eca0935646697a2908320b8a2389fd958c34aaea
SHA256

c28c69a703c04cd9f8292cdacb15d669bf8535245a211994f485637d8b9a0fc1
SHA512

d92d269f8dd83b9f2e9550e2b7690e9b2dcbd2b1a4ff3fbc8c174d8ff186fcdc0155036e5319ce5da58508634bfa3f0e0e536e439bb20e9395beef19764bf507
SSDEEP

24576:sGZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk7L:QwwvuziiV/iXxc6Z5WODYsHh6g3P0zAu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1696	2400	rundll32.exe	28
PID 2400 wrote to memory of 1696	2400	rundll32.exe	28
PID 2400 wrote to memory of 1696	2400	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2400 -s 92
  2⤵
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads