30863f7a149c41c3edb9537a1e93321faab3c68fed49cccbaeddb099388b14ac | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 18:05

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

932KB
MD5

2cd830cd809dcf87d92b2f06ceaeafad
SHA1

220b562cd67566fae6c90b20246475e5c9653f47
SHA256

18e8770322af77f66b64dfbf096638d9e8f13edec0801e53a8506a682cf93dcd
SHA512

cea50c9e8c4686f1dd3a653483727e43dd6a56d939f3b85c033d8e50741f93132fdd0757d7d14ec1cd8cac9cfe8bd1c3de2d3ee671dcba01c02487d0c78783ae
SSDEEP

24576:SB3udp6Q9s8rpPaolZhGd6Z5WiDYsH56g3P0zAk7l18DC:SaDlrpPaoZGd6Z5WiDYsH56g3P0zAk7l

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2560	2576	rundll32.exe	30
PID 2576 wrote to memory of 2560	2576	rundll32.exe	30
PID 2576 wrote to memory of 2560	2576	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2576 -s 88
  2⤵
  PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads