2d17385ee0b70a6b61192b70ed2edc6d67907cd883a8fdb565fad1f357fb7140 | Triage

Analysis

max time kernel
4294619s
max time network
621s
platform
windows7_x64
resource
win7-20220310-en
submitted
16-03-2022 16:53

Sharing

Report Analysis Logs

General

Target

Bloom/libGLESv2.dll
Size

7.8MB
MD5

f0491de8163465685eb5b824ce083d98
SHA1

d079d44a544fb8f1395202f15889928d35cfe8fc
SHA256

eb22c1d16db8e23270b444c7a021ba65331fa7b456fd911f3133599bddd42189
SHA512

f7d80c4848402c2021be90eafe7c799547efd7365c31eddb775afcf677134cd1d9a5c982b930e5b8f962a1aa8075b23d31bb070e8d28602f6336bede73c4f86b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
872	1936	WerFault.exe	23

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 872	1936	rundll32.exe	29
PID 1936 wrote to memory of 872	1936	rundll32.exe	29
PID 1936 wrote to memory of 872	1936	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bloom\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1936 -s 92
  2⤵
  - Program crash
  PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads