46e1f4257b5fbfbfbdcdb11eeafa0b91893385cf28972eb672ffc9fe906175ab | Triage

Resubmissions

28/07/2024, 17:32

240728-v397layfmg 7

28/07/2024, 17:11

240728-vqcqkayakd 7

11/07/2024, 10:44

240711-mstg4avhlf 7

Analysis

max time kernel
9s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/07/2024, 17:32

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

906KB
MD5

6d4adf9a48dbce2e480ef10b1338ca3c
SHA1

ceb77d5768c6eda84ec8e0b43821b8027764de81
SHA256

4cca7e6c05b2d988926e4b4d0c8ff91d6356f18de8bf40b440251180e5cad6a7
SHA512

106db7309b40afabb1cca911b204c83129683dc116aec198568c4228c581bf0de5963bffc0b50df8f43ec355264f271fc383f4155be45350c0d7dd429c7f7f09
SSDEEP

24576:IEW7F7IyaHx/fempu2e6Z5WODYsHh6g3P0zAk7o:e7IyaBfempa6Z5WODYsHh6g3P0zAk7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 1320	2560	rundll32.exe	30
PID 2560 wrote to memory of 1320	2560	rundll32.exe	30
PID 2560 wrote to memory of 1320	2560	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2560 -s 88
  2⤵
  PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads