5e471e38380ea1289c02d39543962ee2d94de903d00c7bfb53bf8510dac19dbf | Triage

Analysis

max time kernel
7s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 10:56

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

906KB
MD5

6c70aab071c4febc5921e0d39811937a
SHA1

20d87b3a5333ea3f6d0d7b0333f2c30a281937aa
SHA256

2233fef6788711089fc5c1a008bfff6559cf2fc3e8363cd8a50196e90d1d9825
SHA512

7f786c44376b59be7d7c51d3c40ecb80f30645551b582d042b641ea0a6464daf367ddf7eafaf00a1558e1f11570d99a699d33d224b01048d09f8f00ea501c4bf
SSDEEP

24576:yGZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk7a:GwwvuziiV/iXxc6Z5WODYsHh6g3P0zAu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3008 wrote to memory of 2552	3008	rundll32.exe	WerFault.exe
PID 3008 wrote to memory of 2552	3008	rundll32.exe	WerFault.exe
PID 3008 wrote to memory of 2552	3008	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3008 -s 92
  2⤵
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads