10273efcac023d59fc68901d4d4fcf3ca59858fbca92ffb81243ccd49784218d | Triage

Analysis

max time kernel
152s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 16:07

Sharing

Report Analysis Logs

General

Target

GDHM_TASBOT_v35.6/libGLESv2.dll
Size

5.4MB
MD5

0247d1115b7c5bad5c42f752df2eecb5
SHA1

517e175300e6b62ab0490ffbbeb09710455cefa1
SHA256

db8e70356ddb6c9a6ca44e77cb71f61c41b022d3e6dc2c549128c9d7dae215a5
SHA512

7a962755630af57d3f26c36095413159a034b123703679610cf274f6d061c19e17998db8d80a353e5b82495a40c67d8a94a8ac87ea8df02227815ea535001d69
SSDEEP

98304:EqrK2BX3QtqV3vqUWGan8R5JNJM9UU3hbPHD/fhK1fd:rBX3d3W6rM9UU3hH

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4460 4156 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2076 wrote to memory of 4156	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 4156	2076	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 4156	2076	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\libGLESv2.dll,#1
2⤵
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 612
3⤵
- Program crash
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4156 -ip 4156
1⤵
PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads