a462832a6ef922ea45ecd990a86bd57bb086d89ed0bc9c604b73cb3a10792261

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 12:55

Target
vulkan-1.dll
Size 906KB
Sample241121-p5va9sslf1
SHA256 2233fef6788711089fc5c1a008bfff6559cf2fc3e8363cd8a50196e90d1d9825
MD5 6c70aab071c4febc5921e0d39811937a
SHA1 20d87b3a5333ea3f6d0d7b0333f2c30a281937aa
SHA512 7f786c44376b59be7d7c51d3c40ecb80f30645551b582d042b641ea0a6464daf367ddf7eafaf00a1558e1f11570d99a699d33d224b01048d09f8f00ea501c4bf
SSDEEP 24576:yGZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk7a:GwwvuziiV/iXxc6Z5WODYsHh6g3P0zAu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1984	2024	rundll32.exe	31
PID 2024 wrote to memory of 1984	2024	rundll32.exe	31
PID 2024 wrote to memory of 1984	2024	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2024 -s 88
  2⤵
  PID:1984