030de2abcea938201bbb22786107967b412a4fd9a97ed39e09a4063fcbf88b2f | Triage

Resubmissions

11/08/2024, 22:04

240811-1y9cdsvdqa 9

11/08/2024, 22:02

240811-1xxbfazhmk 9

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 22:02

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

925KB
MD5

47af18d68dc7cf271f0a92707f783f64
SHA1

64594e92a1cd7042cf6367b1843abed210db3d78
SHA256

d5df2f59cc8b32abd6178250e7d1370a7f37270cc727449e21778080b5e29cd2
SHA512

2e8fefeccc25e5fcb448fd874f99b8d1466a8148ffe80e1f6ac2105d18bb93e529681ff0ba38e515f52ed4df9ac091fee0782afe5e093fd83c3045a60409fc10
SSDEEP

24576:Ty+lCO+5ia/1DW6pb9MLtX6Z5WdDYsH26g3P0zAk7o34:TymVqXpbId6Z5WdDYsH26g3P0zAk7oo

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2868	2396	rundll32.exe	30
PID 2396 wrote to memory of 2868	2396	rundll32.exe	30
PID 2396 wrote to memory of 2868	2396	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2396 -s 88
  2⤵
  PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads