56b2ad26e590842ced4ee1d987694c8fc4f7f556fbca6fad90dbe39ff71b5260

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21-07-2023 06:54

Target

Act I - Veda/libGLESv2.dll
Size

5.2MB
MD5

c0c46ffb8a2f937b67b116a829efec86
SHA1

bc71dc67f58cb3e85b0b92ae9c67d72bec68463d
SHA256

b0d89b453c9a40dfa7f8fb7df38f1161dd7b44a1b61624debd08b3197ffa330d
SHA512

da68cbfb8d29c2193629d2b160525d17e66018e2a275578239eb9cad52a2412d406a2870c932d837807162f051442674de2abfa535bffd0d3c102f140931da16
SSDEEP

49152:QFqVP2tu+u/mjMWSPew+sG5DwsX+Kkd0CFr2ArMqs/vCJNXHDOlBAVMCsikqsvBu:betu+u/mBS2YeE9S0ClWIEHVeEquZB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2556	2044	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2556	2044	rundll32.exe	28
PID 2044 wrote to memory of 2556	2044	rundll32.exe	28
PID 2044 wrote to memory of 2556	2044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Act I - Veda\libGLESv2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2044 -s 160
  2⤵
  - Program crash
  PID:2556