e44fd281ff4ac842d66917e5f7bf43d7cf6b94afce95df2c8ee238e61cfbd0cd | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 22:17

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

894KB
MD5

c286e1191c5b91130b6d16e23cbd44f3
SHA1

8231664efdf30b07ff0dbc6b6f4e4d46ec574de0
SHA256

8d4b92d08f42bfe9d30362b9cf671fd6ae3166ade44f94de17dfc531393b66cd
SHA512

5cd07f2edec7bbe8684ea291a9d1dd3709f6a25c55fda3d92938eaf9c3b047ec481e3e7f3fc64973f6833422ab5880f1318a15afa666e2dd207763c7d3822bbd
SSDEEP

12288:0P1VNNJPqXu9D8xeLoCzG4JsZGS5ld/YlmQAuYvyRnsBsoj88C29h:0PXJPq+9QeLpDpmQ/YJBse79h

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2868	2840	rundll32.exe	30
PID 2840 wrote to memory of 2868	2840	rundll32.exe	30
PID 2840 wrote to memory of 2868	2840	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2840 -s 88
  2⤵
  PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads