c5f1dfbf8d4b1d8d5c43f668292056d5b670fea174e6e79d3cc2ba341d66a21f | Triage

Analysis

max time kernel
13s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 03:32

Sharing

Report Analysis Logs

General

Target

data/libGLESv2.dll
Size

7.1MB
MD5

2dbb82b699fde23616bb09bbc682f02d
SHA1

ab61757008822e8e4e3d5224926baa0d7f5a0e5d
SHA256

6fe416e5df17c9e324c0cbbfac1221e43b8864052443c54712b7c0c03b511c0a
SHA512

e2af408951318c942ae2de9faf3b681c9977e6c7e4a7a0ac74c77e0d39918ef23a54f46b7f1c5d2bc2cf95a0a593bb0be7dca36705bb98d8f3ff65084a99edcc
SSDEEP

98304:uuM171ZvG5Q570CSPnSFguTgLDxZzXJh4+c+gsOMu:V2V5RSPusHxKtFsc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2032	1252	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2032	1252	rundll32.exe	28
PID 1252 wrote to memory of 2032	1252	rundll32.exe	28
PID 1252 wrote to memory of 2032	1252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1252 -s 92
  2⤵
  - Program crash
  PID:2032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads