ac94101c9d78aded5c0ce3207fb99bb4cb7083ec635b6fe7ed26b9414930d7ae | Triage

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 21:58

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

346KB
MD5

a0d30035b72b15d78046a8abc068e225
SHA1

8461b741e0119b45f05a55da201b378d9779625f
SHA256

c6bc32bc659fb5813bdb8175a342e9044997e93bde6332419e2160afc4fe6bda
SHA512

016058ea41e5af33e0f42893678bd20a108c40bb4e7b9239b24887d1756e8d669323a4b3c3b287b3095aafbb063612f692dad8fb3cab9ebdae9a9f392f4e3a44
SSDEEP

6144:VMsJQmSGv9SHEOCK6tNu2JztBwNWqERYRg2Z4uVPZIcwpJAc21DNNbTm:VmERK6tNVwNWqEnFuVPicAwK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 3404	3852	rundll32.exe	89
PID 3852 wrote to memory of 3404	3852	rundll32.exe	89
PID 3852 wrote to memory of 3404	3852	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
  2⤵
  PID:3404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads