46e1f4257b5fbfbfbdcdb11eeafa0b91893385cf28972eb672ffc9fe906175ab

Resubmissions

28/07/2024, 17:32

28/07/2024, 17:11

11/07/2024, 10:44

max time kernel
9s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/07/2024, 17:32

Target
vulkan-1.dll
Size 906KB
Sample240728-v397layfmg
SHA256 4cca7e6c05b2d988926e4b4d0c8ff91d6356f18de8bf40b440251180e5cad6a7
MD5 6d4adf9a48dbce2e480ef10b1338ca3c
SHA1 ceb77d5768c6eda84ec8e0b43821b8027764de81
SHA512 106db7309b40afabb1cca911b204c83129683dc116aec198568c4228c581bf0de5963bffc0b50df8f43ec355264f271fc383f4155be45350c0d7dd429c7f7f09
SSDEEP 24576:IEW7F7IyaHx/fempu2e6Z5WODYsHh6g3P0zAk7o:e7IyaBfempa6Z5WODYsHh6g3P0zAk7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1320	2560	rundll32.exe	30
PID 2560 wrote to memory of 1320	2560	rundll32.exe	30
PID 2560 wrote to memory of 1320	2560	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2560 -s 88
  2⤵
  PID:1320