ac94101c9d78aded5c0ce3207fb99bb4cb7083ec635b6fe7ed26b9414930d7ae | Triage

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2023, 21:58

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

6.6MB
MD5

102618068fd794b647ada07d3a5e1e5c
SHA1

946662a13920aaeb6bdefe52aefbcbf115f32e08
SHA256

4ae8097e243db19207fc59cc98ccd4b2c2f565d31de2aabe12d8de84024a5aef
SHA512

eaa4e967f4a53abef7497cdfafbb07e2eceb2487cb42ce698eb6f6936ed4d6209b8b3a8bd01dc36f62b987fd1fdf6cdcd7e8b81e7d34012a8d1024be63f089fd
SSDEEP

98304:1QCmxsiSpK4kYN3aWm6nEhq+kY5H/nNqkyxSJ5Vy0EEZUsvI:1QCmxb2KfW53+kYl/A7dtt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3540	2652	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 2652	536	rundll32.exe	88
PID 536 wrote to memory of 2652	536	rundll32.exe	88
PID 536 wrote to memory of 2652	536	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
  2⤵
  PID:2652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 612
    3⤵
    - Program crash
    PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2652 -ip 2652
1⤵
PID:3952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads