10273efcac023d59fc68901d4d4fcf3ca59858fbca92ffb81243ccd49784218d | Triage

Analysis

max time kernel
12s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-03-2023 16:07

Sharing

Report Analysis Logs

General

Target

GDHM_TASBOT_v35.6/libGLESv2.dll
Size

5.4MB
MD5

0247d1115b7c5bad5c42f752df2eecb5
SHA1

517e175300e6b62ab0490ffbbeb09710455cefa1
SHA256

db8e70356ddb6c9a6ca44e77cb71f61c41b022d3e6dc2c549128c9d7dae215a5
SHA512

7a962755630af57d3f26c36095413159a034b123703679610cf274f6d061c19e17998db8d80a353e5b82495a40c67d8a94a8ac87ea8df02227815ea535001d69
SSDEEP

98304:EqrK2BX3QtqV3vqUWGan8R5JNJM9UU3hbPHD/fhK1fd:rBX3d3W6rM9UU3hH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1632 1236 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1640 wrote to memory of 1236	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1236	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1236	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1236	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1236	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1236	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1236	1640	rundll32.exe	rundll32.exe
PID 1236 wrote to memory of 1632	1236	rundll32.exe	WerFault.exe
PID 1236 wrote to memory of 1632	1236	rundll32.exe	WerFault.exe
PID 1236 wrote to memory of 1632	1236	rundll32.exe	WerFault.exe
PID 1236 wrote to memory of 1632	1236	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\libGLESv2.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 224
3⤵
- Program crash
PID:1632

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...