Overview
overview
10Static
static
10OneLaunch\...me.dll
windows7-x64
3OneLaunch\...me.dll
windows10-2004-x64
3OneLaunch\...lf.dll
windows7-x64
1OneLaunch\...lf.dll
windows10-2004-x64
1OneLaunch\...um.exe
windows7-x64
OneLaunch\...um.exe
windows10-2004-x64
OneLaunch\...47.dll
windows7-x64
3OneLaunch\...47.dll
windows10-2004-x64
3OneLaunch\...GL.dll
windows7-x64
1OneLaunch\...GL.dll
windows10-2004-x64
1OneLaunch\...v2.dll
windows7-x64
3OneLaunch\...v2.dll
windows10-2004-x64
3Analysis
-
max time kernel
892s -
max time network
901s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2023 19:47
Behavioral task
behavioral1
Sample
OneLaunch\5.3.5\chromium\chrome.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
OneLaunch\5.3.5\chromium\chrome.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
OneLaunch\5.3.5\chromium\chrome_elf.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
OneLaunch\5.3.5\chromium\chrome_elf.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
OneLaunch\5.3.5\chromium\chromium.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
OneLaunch\5.3.5\chromium\chromium.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
OneLaunch\5.3.5\chromium\d3dcompiler_47.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
OneLaunch\5.3.5\chromium\d3dcompiler_47.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
OneLaunch\5.3.5\chromium\libEGL.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
OneLaunch\5.3.5\chromium\libEGL.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
OneLaunch\5.3.5\chromium\libGLESv2.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
OneLaunch\5.3.5\chromium\libGLESv2.dll
Resource
win10v2004-20230220-en
General
-
Target
OneLaunch\5.3.5\chromium\libGLESv2.dll
-
Size
5.2MB
-
MD5
066d1c8147972e194c19e61fcfbc64f4
-
SHA1
fe78e6f639d62484baea4f4ba0b28541ade0cf52
-
SHA256
107decd6daa4c91ff8a22f4f250db201bc0b8653297b6bd04f0b2b3419834453
-
SHA512
b2973dc4a0a930096657f899e24729b962913cff050997c064cd209d7083105baed75c6221b9fd4c83042c71964ce0ec83ed10efc8888868cbd81c862c8e0bb0
-
SSDEEP
98304:BsdBzuQq86fv0CvWyvImrYvmzu1VXKC1D35DoOj:oUQqB/WyAmsvma1VXzZj
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2024 2044 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2032 wrote to memory of 2044 2032 rundll32.exe rundll32.exe PID 2032 wrote to memory of 2044 2032 rundll32.exe rundll32.exe PID 2032 wrote to memory of 2044 2032 rundll32.exe rundll32.exe PID 2032 wrote to memory of 2044 2032 rundll32.exe rundll32.exe PID 2032 wrote to memory of 2044 2032 rundll32.exe rundll32.exe PID 2032 wrote to memory of 2044 2032 rundll32.exe rundll32.exe PID 2032 wrote to memory of 2044 2032 rundll32.exe rundll32.exe PID 2044 wrote to memory of 2024 2044 rundll32.exe WerFault.exe PID 2044 wrote to memory of 2024 2044 rundll32.exe WerFault.exe PID 2044 wrote to memory of 2024 2044 rundll32.exe WerFault.exe PID 2044 wrote to memory of 2024 2044 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\OneLaunch\5.3.5\chromium\libGLESv2.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\OneLaunch\5.3.5\chromium\libGLESv2.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 2243⤵
- Program crash