59821b8aabe5acc8b1eb91ed2de2cba91b05351c3d9e3bf52ba0ba786f359b87 | Triage

Analysis

max time kernel
4294362s
max time network
319s
platform
windows7_x64
resource
win7-20220311-en
submitted
22-03-2022 15:39

Sharing

Report Analysis Logs

General

Target

Bloom/libGLESv2.dll
Size

7.8MB
MD5

f0491de8163465685eb5b824ce083d98
SHA1

d079d44a544fb8f1395202f15889928d35cfe8fc
SHA256

eb22c1d16db8e23270b444c7a021ba65331fa7b456fd911f3133599bddd42189
SHA512

f7d80c4848402c2021be90eafe7c799547efd7365c31eddb775afcf677134cd1d9a5c982b930e5b8f962a1aa8075b23d31bb070e8d28602f6336bede73c4f86b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
588	1824	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 588	1824	rundll32.exe	27
PID 1824 wrote to memory of 588	1824	rundll32.exe	27
PID 1824 wrote to memory of 588	1824	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bloom\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1824 -s 92
  2⤵
  - Program crash
  PID:588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads