5cc00ae1de23e2b24fa73616f060cce21564182a87233c3343c9d443efc30430 | Triage

Analysis

max time kernel
117s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 17:27

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

932KB
MD5

a6588e66186ccf486eede8e9223f0d41
SHA1

777a5c4028c7675ee1fc4e265a825b35d5099577
SHA256

419488597ea255ec61f028aeecd36572d072dfe49b7ab716cd2c0a8e186f24e6
SHA512

ba8b9577f47ac5b9503aab8d4cca6059c7208bf0eb37999f4fbef0c2cf03032a9359559a0221f332c6cd66c38366fb0e1f1d32173f282afd639fabea8fc9400e
SSDEEP

24576:kB3udp6Q9s8rpPaolZhGd6Z5WiDYsH56g3P0zAk7l1/DC:kaDlrpPaoZGd6Z5WiDYsH56g3P0zAk7l

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 796 wrote to memory of 1628	796	rundll32.exe	WerFault.exe
PID 796 wrote to memory of 1628	796	rundll32.exe	WerFault.exe
PID 796 wrote to memory of 1628	796	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 796 -s 100
  2⤵
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads