fe872afe5117141a4c973be22159fe4ddd8b779ebf740e44a3a054255e842b23 | Triage

Analysis

max time kernel
129s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20/07/2024, 12:16

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

786KB
MD5

a947c5d8fec95a0f24b4143ced301209
SHA1

ebf3089985377a58b8431a14e22a814857287aaf
SHA256

29cb256921a1b0f222c82650469d534ccdf038d1f395b3aaa9f1086918f5d3fa
SHA512

75f5e055f4422b5558fc1cb3ea84fb7cbeaae6f71c786cc06c295d4ab51c0b1c84e28a7c89fe544f007dbe8e612bed4059139f1575934fe4bac8e538c674ebd3
SSDEEP

24576:cJObHhG7TEnCGlrpZpjL4TB46Z5WODYsHh6g3P0zAk722:c0c7TECgpZpju46Z5WODYsHh6g3P0zA+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2984	4004	WerFault.exe	73

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 4004	2752	rundll32.exe	73
PID 2752 wrote to memory of 4004	2752	rundll32.exe	73
PID 2752 wrote to memory of 4004	2752	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
  2⤵
  PID:4004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 624
    3⤵
    - Program crash
    PID:2984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads