c557ef35306f3c41ffc576287d2f4b58ae34f7e6370c0f5f6e2d4f23839b0cd9 | Triage

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
27/11/2023, 01:55

Sharing

Report Analysis Logs

General

Target

av_libglesv2.dll
Size

4.2MB
MD5

73d2fb4c35d323813a86e3bf5c85c345
SHA1

81f751a34e0c25bdea93902a19a94a49ce1495df
SHA256

85b3aee47c0e0eaf3a5ea5c75ba8131387a12639b6a0ef280c28531fb77695ae
SHA512

e81677cc9b99ff3d54f67000a60489603e01a896f90c4ef0c883b82e2fdb7b90d2899c078958b3f060a20373b99cb6c4deb7f64cc4c7e0ba2a708209f4684ca4
SSDEEP

49152:I1qISHMa72SRXc0kFg760EvAy4U5hDempTKkslMx0YEQtHhcEIy/rcgcrq8T/2tj:vbMNgMdth1t

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2256	1968	rundll32.exe	28
PID 1968 wrote to memory of 2256	1968	rundll32.exe	28
PID 1968 wrote to memory of 2256	1968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\av_libglesv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1968 -s 92
  2⤵
  PID:2256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads