3a3be4d63ea60273d2a4eda55d735e5f5066d564b9512ef0852e075e684bdd46 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31/01/2025, 16:38

Sharing

Report Analysis Logs

General

Target

vulkan-1.dll
Size

910KB
MD5

d562628f9df56ae61770ffdef79c8d05
SHA1

2423105a960fe0ceb038ca36d6a37638ebd32b6f
SHA256

5789ca1822f3a5a67cd2c24e6ff0307e688b76a2e99831050bdcf8b8d155956d
SHA512

739f9f41d8e3e48dbd20bfecfc5679f38e59b3fc8cb406a77c384fd5146f19efafa1e4f23f15071dbeaa1d0dc71e125966e19fb757fc39e6abe953159669c096
SSDEEP

24576:FoHDVVdrfQ09CPKuy0O0Q6Z5W0DYsHA6g3P0zAk7s+:FuVdrI0GKuy066Z5W0DYsHA6g3P0zAkz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 2460	1228	rundll32.exe	30
PID 1228 wrote to memory of 2460	1228	rundll32.exe	30
PID 1228 wrote to memory of 2460	1228	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1228 -s 88
  2⤵
  PID:2460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads