86fa31bd1206ddf10caf34f5c3d2bea9fb09014052e2d8a28790921def72b6de | Triage

Analysis

max time kernel
1562s
max time network
1569s
platform
windows7_x64
resource
win7-20240708-it
resource tags

arch:x64arch:x86image:win7-20240708-itlocale:it-itos:windows7-x64systemwindows
submitted
12/07/2024, 21:18

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

717KB
MD5

a609939e08a8e96b3b0c0b14f95ed438
SHA1

577eb64e6768fc373027288728c03c2466476294
SHA256

8ed0495528846a950fbc97c5f3623987dd0854680aec2cea4c564839616a9d7a
SHA512

5dc69c5c3c1a2ae189416bcfeeab30844e4abf6ea969b89ba212012229d84010ba303206f476f80847be493bb8aef83ab0c9ee98ae59820f0f71a434fb0e0b76
SSDEEP

12288:wsOB/RHD2o+MfwiVLz7g8aCJ4gabDX7moMbIl:wsONx2o+MJvk8aC7UDCv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2408	2164	rundll32.exe	30
PID 2164 wrote to memory of 2408	2164	rundll32.exe	30
PID 2164 wrote to memory of 2408	2164	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2164 -s 92
  2⤵
  PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads