8d7e3ee51b3228c604b607ad50508f60658f61793f802ee9236f288a17d512dd

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 17:05

Target
vulkan-1.dll
Size 933KB
Sample240627-vlwymstbkl
SHA256 a73ef0a1dc0578cf64e856dc9461ba135bd742f3d5f60713e4d645e17533e9c9
MD5 e43b12cf3c7a21a5c50d3c7b4f88ab04
SHA1 79664cf6cfb23c3e78361f817bac1440e6c7fe41
SHA512 656841544adf4fac2abde64bd62bc9392e76178797e81f73a13af05f84e6f51ad83aba1320a2af17e910bc3eb35c40ef9ba386f36ebd443ac04acefc10dc0248
SSDEEP 24576:57SR7TmAl/bFPmGDsfNy6Z5WiDYsH56g3P0zAk7LZIOayz:57A/bFPmH86Z5WiDYsH56g3P0zAk7LE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2344	2336	rundll32.exe	28
PID 2336 wrote to memory of 2344	2336	rundll32.exe	28
PID 2336 wrote to memory of 2344	2336	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2336 -s 88
  2⤵
  PID:2344