30091faafd62ea7ba9868db2ee575dab98fd126a78d39590f57ea7b38b20d966 | Triage

Resubmissions

02-12-2024 01:25

241202-bszhkaxlfj 7

21-09-2024 21:03

240921-zwgnxstdke 10

21-09-2024 20:29

240921-y9lz5asajd 10

Analysis

max time kernel
1563s
max time network
1568s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 01:25

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

932KB
MD5

a6588e66186ccf486eede8e9223f0d41
SHA1

777a5c4028c7675ee1fc4e265a825b35d5099577
SHA256

419488597ea255ec61f028aeecd36572d072dfe49b7ab716cd2c0a8e186f24e6
SHA512

ba8b9577f47ac5b9503aab8d4cca6059c7208bf0eb37999f4fbef0c2cf03032a9359559a0221f332c6cd66c38366fb0e1f1d32173f282afd639fabea8fc9400e
SSDEEP

24576:kB3udp6Q9s8rpPaolZhGd6Z5WiDYsH56g3P0zAk7l1/DC:kaDlrpPaoZGd6Z5WiDYsH56g3P0zAk7l

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2944	2168	rundll32.exe	31
PID 2168 wrote to memory of 2944	2168	rundll32.exe	31
PID 2168 wrote to memory of 2944	2168	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2168 -s 88
  2⤵
  PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads