7ee8f22c98aa12fd857957b213a700b35b3b57522e17d0b584455d08d7cdca4c | Triage

Analysis

max time kernel
93s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2022 10:17

Sharing

Report Analysis Logs

General

Target

Lumion 12 Pro/donut/libGLESv2.dll
Size

1.3MB
MD5

69ac8131eb79ea07cde195d2d27508e6
SHA1

4d59d5fd732b2114ab7b0f96158e234e2fb1237b
SHA256

295f132666cbf1eeea2376e56844257e3c6a9bc3da2ffcfc48e08787343c9569
SHA512

66c9e91d690b634f013d502c3e89989735475dad2c637e77d767c174dbc12dc6df7a855a65830e0d796f7d943229a033af76c70e8c5a7a119a90e8d24b7e2e1c
SSDEEP

24576:347pmYf8rDQTOMYSNQamVEUEj0KwmZkCIOO8r:Pwewj6mCROO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 4388	4872	rundll32.exe	80
PID 4872 wrote to memory of 4388	4872	rundll32.exe	80
PID 4872 wrote to memory of 4388	4872	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Lumion 12 Pro\donut\libGLESv2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Lumion 12 Pro\donut\libGLESv2.dll",#1
  2⤵
  PID:4388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads