204675ed11d30dd3dbc631f798b4364c128eb4e9413f1da195790abf880e8b9a | Triage

Analysis

max time kernel
137s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2022 17:41

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.6MB
MD5

dfcb482c34211c3b5e6bcbc36f00d044
SHA1

89f114d199d45f945b0fe42b1043420d4e9c427a
SHA256

d54373072028fbcf89716c3479a241ebd452410848f654927f2d140a02c0fc8e
SHA512

2962c656a0098c24b36c416730c62abdd1fca047f19e32d8b2eaedc86a587674b98a270c43cdc94642d9769cae256c291f62ba8e9593f58e3cc102e51397971e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4460 wrote to memory of 4500	4460	rundll32.exe	rundll32.exe
PID 4460 wrote to memory of 4500	4460	rundll32.exe	rundll32.exe
PID 4460 wrote to memory of 4500	4460	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
2⤵
PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4500-130-0x0000000000000000-mapping.dmp

Download