b7ca33c868d337fdb80802f2b5b7ea545297de765553df419e0b53aae6b3d542 | Triage

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 01:08

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

906KB
MD5

6c70aab071c4febc5921e0d39811937a
SHA1

20d87b3a5333ea3f6d0d7b0333f2c30a281937aa
SHA256

2233fef6788711089fc5c1a008bfff6559cf2fc3e8363cd8a50196e90d1d9825
SHA512

7f786c44376b59be7d7c51d3c40ecb80f30645551b582d042b641ea0a6464daf367ddf7eafaf00a1558e1f11570d99a699d33d224b01048d09f8f00ea501c4bf
SSDEEP

24576:yGZKHQwvuzUrfafN/iXxT+R6Z5WODYsHh6g3P0zAk7a:GwwvuziiV/iXxc6Z5WODYsHh6g3P0zAu

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1660 wrote to memory of 2812	1660	rundll32.exe	29
PID 1660 wrote to memory of 2812	1660	rundll32.exe	29
PID 1660 wrote to memory of 2812	1660	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1660 -s 88
  2⤵
  PID:2812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads