e90406dc4f863b69aa640e7cd3ce6ac8833348e8d3d0f8ffc355276a65de4e78 | Triage

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 10:09

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.3MB
MD5

05b585464f18fe0e3bddb20527697d66
SHA1

8bcec2f0b409afa9ff054e25f3ce85eb9bd50010
SHA256

0bb7c6c08b569c1d2de90a40e6c142591e160a7c6cb15d21807f3404a48c4287
SHA512

f680ab9c3070f443c7359bb3f0c2032f5c58c88c7823e4592e8212ce8815ea5f463c86df113f5320944c62d3cb4e8d45b9b4dcaadccc1ac9bf203ae4bb52083c
SSDEEP

98304:WJTPQhRQ4t2fzqJ3IZ155Rl5F/tpcAgsOMN:Wm2foIzRJosr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2272 wrote to memory of 2220	2272	rundll32.exe	WerFault.exe
PID 2272 wrote to memory of 2220	2272	rundll32.exe	WerFault.exe
PID 2272 wrote to memory of 2220	2272	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2272 -s 88
2⤵
PID:2220

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...