6a0664da0332aa8f4428914ba6aff37506fd239776a881e6d24f1cf5b60cbb70

Resubmissions

24-09-2023 15:33

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
24-09-2023 15:33

Target

libGLESv2.dll
Size

7.1MB
MD5

cff57a1a15a2c73f156f3598bfaddd55
SHA1

13b097e7a1c9dc47419f8fc1f53a86af42a09d7f
SHA256

44393afbd99d287f5590007915405888a59cf5872175643f53a03c394b735068
SHA512

536caad0dcb416156724284b3b726ee234a0bca3a1abb6fad92f2ec175337466191146da5db55b5cda9f6f489a6d154f2a41998e77521629ff42d30d81d16fb3
SSDEEP

49152:aW1dWVceEkEZQtf9zpatRabLAfZurAM2A1qgNUWvYuoDuuZWtM0l3U2KYT1dTjni:0EBRgd7jrTjc+qkesblM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3036 wrote to memory of 2680	3036	rundll32.exe	WerFault.exe
PID 3036 wrote to memory of 2680	3036	rundll32.exe	WerFault.exe
PID 3036 wrote to memory of 2680	3036	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3036 -s 92
2⤵
PID:2680