204675ed11d30dd3dbc631f798b4364c128eb4e9413f1da195790abf880e8b9a | Triage

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2022 17:41

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

65KB
MD5

683fe751705a3876223557ed3f1cf9d2
SHA1

5438089276978a3953c36f6b996c9bc9972326b7
SHA256

2bfca8ad96c13910febd0e4b43476668590ec0e9bcf3adfd8fef927bee36c394
SHA512

8c279aaa5de7fb3b2c8690d1c74d987ab99b7178c90925b8de692d9ee0079e7033102e3abb717a2469fdb5e7cac6bfe5a62c52574fd273ad11fb9f79eb458d33

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4940 wrote to memory of 1408	4940	rundll32.exe	rundll32.exe
PID 4940 wrote to memory of 1408	4940	rundll32.exe	rundll32.exe
PID 4940 wrote to memory of 1408	4940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
2⤵
PID:1408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-130-0x0000000000000000-mapping.dmp

Download
memory/1408-131-0x0000000002280000-0x00000000026D2000-memory.dmp

Filesize
4.3MB

Download
memory/1408-133-0x0000000002280000-0x00000000026D2000-memory.dmp

Filesize
4.3MB

Download
memory/1408-134-0x0000000002280000-0x00000000026D2000-memory.dmp

Filesize
4.3MB

Download