261c74483d79cc6bb654b39e7e1ef75dddd7c38f5bbffce6c55472cc7398d745

Analysis

max time kernel
149s
max time network
116s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vulkan-1.dll
Size 8.8MB
Sample260421-w2celsat8q
SHA256 261c74483d79cc6bb654b39e7e1ef75dddd7c38f5bbffce6c55472cc7398d745
MD5 83b4a96ce6035210af279ff6db0efd64
SHA1 1402c4c5ac5afa161986fac88be652dd2ee7cd92
SHA512 be10ea833eca6fae55e43615db7dcb3a4dda6a3fa1f7ac2f3807db1ee1e0ad2dad027faaa475a107a39b6ed5564cb261cab9cd17eb167d55c626e95f0914b083
SSDEEP 196608:2t9VBp3q0aTgQ1Oqk0AxVSN4zwl2IdlUNbRX5oU3R:A9VjaefxVo4zg2IjyReU
TLSH
T1E696E0A36109027AC712053034F69B36EE657E4D2B2149EB1F9BBE2E7F322D14DF6506
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

persistence

Malware Config

Signatures

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Overwolf.exe	rundll32.exe
File opened for modification	C:\Program Files\Common Files\install.cfg	rundll32.exe
File opened for modification	C:\Program Files\Common Files\temp.key	rundll32.exe
File opened for modification	C:\Program Files\Common Files\vulkan-1.bin	rundll32.exe
File opened for modification	C:\Program Files\Common Files\vulkan-1.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2732	rundll32.exe
2732	rundll32.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vulkan-1.dll,#1
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-0-0x0000000180000000-0x000000018004B000-memory.dmp

Download

memory/2732-4-0x00007FF89D9E0000-0x00007FF89DBE9000-memory.dmp

Download

memory/2732-6-0x00000222FE4E0000-0x00000222FE4E1000-memory.dmp

Download

memory/2732-5-0x00007FF87E460000-0x00007FF87ED28000-memory.dmp

Download

memory/2732-7-0x00000222FE7D0000-0x00000222FEF7E000-memory.dmp

Download

memory/2732-8-0x00007FF87E460000-0x00007FF87ED28000-memory.dmp

Download