65f963bc3c4466d55ecb3f15295be97eaad188c9c73f4bef241c3bf46d95b4f3 | Triage

Analysis

max time kernel
11s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 11:40

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

917KB
MD5

5148e286ea76b5c3a01656a84548d035
SHA1

9f90b7523c64c62d7b0adf4511b49a3f2bb022eb
SHA256

7fb87a7f0d50007dca64bf845d444fc66116a57edecdd8487c91d6879b578a0f
SHA512

23527f9eedc4873320c65b91afd90873febce3f666470dbaaa42e1165c4b864f1df19038bb272954eb2281bb103c15199c6ff25ca44c0ecbfebfa1f5b34c01d6
SSDEEP

24576:wV9nIy2kwpHHPDnCo3A1XpQ66Z5WoDYsHs6g3P0zAk7MG3:0t2zNLnxA1+66Z5WoDYsHs6g3P0zAk7v

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1320	1660	rundll32.exe	30
PID 1660 wrote to memory of 1320	1660	rundll32.exe	30
PID 1660 wrote to memory of 1320	1660	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1660 -s 88
  2⤵
  PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads