0049ff8214d96fe8a7f5dd40934dad318226ef6b7222aea2a730b7983734816a

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 00:54

Target
vulkan-1.dll
Size 932KB
Sample240905-a88kqs1bkf
SHA256 419488597ea255ec61f028aeecd36572d072dfe49b7ab716cd2c0a8e186f24e6
MD5 a6588e66186ccf486eede8e9223f0d41
SHA1 777a5c4028c7675ee1fc4e265a825b35d5099577
SHA512 ba8b9577f47ac5b9503aab8d4cca6059c7208bf0eb37999f4fbef0c2cf03032a9359559a0221f332c6cd66c38366fb0e1f1d32173f282afd639fabea8fc9400e
SSDEEP 24576:kB3udp6Q9s8rpPaolZhGd6Z5WiDYsH56g3P0zAk7l1/DC:kaDlrpPaoZGd6Z5WiDYsH56g3P0zAk7l
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1572	3068	rundll32.exe	31
PID 3068 wrote to memory of 1572	3068	rundll32.exe	31
PID 3068 wrote to memory of 1572	3068	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3068 -s 88
  2⤵
  PID:1572