3b48e8860bf29ef6191cbe0620d0e60b9014857306b955276f04703feee17300 | Triage

Analysis

max time kernel
1783s
max time network
1821s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 16:40

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

931KB
MD5

c05164b53f9508650eff2fadf0df02ef
SHA1

8be89a10846d35a86a573800dc83f3f2646add7f
SHA256

1422520163e4fdd1e575633aeee72530bec59ccc4236a76a98db2720a6b1461a
SHA512

04feeec1e88f330d17b1bef9134565ea3a0cb0d2f8934a77455fa9e5134ce4001ce9752b6d258fcb85ef6fc36b9cc435d41d9801aa8f8d6dbd0905b3b0f7819d
SSDEEP

24576:TYWOq/4Kt/Ku8n387ecbFb6Z5WoDYsHY6g3P0zAk7sL:TY65/M387R56Z5WoDYsHY6g3P0zAk7s

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2612	1460	rundll32.exe	30
PID 1460 wrote to memory of 2612	1460	rundll32.exe	30
PID 1460 wrote to memory of 2612	1460	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1460 -s 92
  2⤵
  PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads