Overview
overview
10Static
static
10OneLaunch\...me.dll
windows7-x64
3OneLaunch\...me.dll
windows10-2004-x64
3OneLaunch\...lf.dll
windows7-x64
1OneLaunch\...lf.dll
windows10-2004-x64
1OneLaunch\...um.exe
windows7-x64
OneLaunch\...um.exe
windows10-2004-x64
OneLaunch\...47.dll
windows7-x64
3OneLaunch\...47.dll
windows10-2004-x64
3OneLaunch\...GL.dll
windows7-x64
1OneLaunch\...GL.dll
windows10-2004-x64
1OneLaunch\...v2.dll
windows7-x64
3OneLaunch\...v2.dll
windows10-2004-x64
3Analysis
-
max time kernel
962s -
max time network
970s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 19:47
Behavioral task
behavioral1
Sample
OneLaunch\5.3.5\chromium\chrome.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
OneLaunch\5.3.5\chromium\chrome.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
OneLaunch\5.3.5\chromium\chrome_elf.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
OneLaunch\5.3.5\chromium\chrome_elf.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
OneLaunch\5.3.5\chromium\chromium.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
OneLaunch\5.3.5\chromium\chromium.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
OneLaunch\5.3.5\chromium\d3dcompiler_47.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
OneLaunch\5.3.5\chromium\d3dcompiler_47.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
OneLaunch\5.3.5\chromium\libEGL.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
OneLaunch\5.3.5\chromium\libEGL.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
OneLaunch\5.3.5\chromium\libGLESv2.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
OneLaunch\5.3.5\chromium\libGLESv2.dll
Resource
win10v2004-20230220-en
General
-
Target
OneLaunch\5.3.5\chromium\libGLESv2.dll
-
Size
5.2MB
-
MD5
066d1c8147972e194c19e61fcfbc64f4
-
SHA1
fe78e6f639d62484baea4f4ba0b28541ade0cf52
-
SHA256
107decd6daa4c91ff8a22f4f250db201bc0b8653297b6bd04f0b2b3419834453
-
SHA512
b2973dc4a0a930096657f899e24729b962913cff050997c064cd209d7083105baed75c6221b9fd4c83042c71964ce0ec83ed10efc8888868cbd81c862c8e0bb0
-
SSDEEP
98304:BsdBzuQq86fv0CvWyvImrYvmzu1VXKC1D35DoOj:oUQqB/WyAmsvma1VXzZj
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2308 952 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3156 wrote to memory of 952 3156 rundll32.exe rundll32.exe PID 3156 wrote to memory of 952 3156 rundll32.exe rundll32.exe PID 3156 wrote to memory of 952 3156 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\OneLaunch\5.3.5\chromium\libGLESv2.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\OneLaunch\5.3.5\chromium\libGLESv2.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 6123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 952 -ip 9521⤵