3c90b3d32f3fe37632edfad2b768cf77d70e7de0d3291d0e5274ea8a7dc69141 | Triage

Analysis

max time kernel
24s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-02-2023 19:44

Sharing

Report Analysis Logs

General

Target

Slither x32y 64/libEGL.dll
Size

74KB
MD5

ab83335258d3197288cbbebbf82f427d
SHA1

d31de342b98f4fa2f572934094063d553fc87caf
SHA256

96be29f99578c53633fefdbb87c77390c6c99e5a9276f1a39680cf87a76f76bb
SHA512

95fd2641c1311efd2d08b9ebbeae8f99c92fc81ad3eae37391134a03b71674f3eb7fab7fa73976f607a2f05c5716620c4657f033887f0b8b6e4630d3c9bfd1e1
SSDEEP

1536:32X7sLvVAe7ii4LtFfgwWJFc8msWjcdc3pyK2/:3Y7wvViLZ0J4yK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28
PID 1216 wrote to memory of 956	1216	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\libEGL.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\libEGL.dll",#1
  2⤵
  PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-54-0x0000000000000000-mapping.dmp

Download
memory/956-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download