dfca2f1a842aea69a2b0a22ca66fa7852f86259e3da4f576f8ae7fa16f1e9134 | Triage

Analysis

max time kernel
51s
max time network
106s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
08-07-2024 09:22

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

625KB
MD5

e823c4dc1d3050418c7075847aef4bde
SHA1

671d7b3b415c86521edad9e82d16800b3b708471
SHA256

5dd0f502fb87cbe3cad54264977d2aee25c52a84e6363f1055e226ce5db5e8d9
SHA512

faa13808b329d3f69a2e6772bee23bb997083227c7452fc2c3e84f25cb682a9c16b4e70926cff9d4f00945dc2be96bd182e25ade2308958ecdec8cc2f2733092
SSDEEP

12288:T+DPc3diJ7q7lPoNokf3Xs7vst9sFJpuKM/6iL9Fe:CDE36c7vsObon5F

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3556 1004 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4972 wrote to memory of 1004	4972	rundll32.exe	rundll32.exe
PID 4972 wrote to memory of 1004	4972	rundll32.exe	rundll32.exe
PID 4972 wrote to memory of 1004	4972	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
2⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 484
3⤵
- Program crash
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1004 -ip 1004
1⤵
PID:3192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads