f07bf397abd8b6bed01b838c3f332319c997f810ee5ec5087e761f1ccc39641a | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 01:15

Sharing

Report Analysis Logs

General

Target

Libs/libEGL.dll
Size

258KB
MD5

3abaa006e1842b5a3cbed2a41476cae8
SHA1

717f3cf9e7c07073f41841cd7fa9858b76265b33
SHA256

a96cdb651c862120489b30b40a716c3f20b772ac4ba8fc70aaccbb1a568005f2
SHA512

84fa2bf370797c7ad2e63287b6e4bb785a88871830ad261ae38afb05cf8bac574f68539bdc0327c3c254a49e52c7da28bc0ee748db99b2f82ca86b08d9f18735
SSDEEP

6144:O1w9H8OGFO/vqX/PSOW8ijs9z6Y1gpAOs+4uL68:O1aUFO/vqX/Pz2sb1gpjzv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1656	1728	rundll32.exe	28
PID 1728 wrote to memory of 1656	1728	rundll32.exe	28
PID 1728 wrote to memory of 1656	1728	rundll32.exe	28
PID 1728 wrote to memory of 1656	1728	rundll32.exe	28
PID 1728 wrote to memory of 1656	1728	rundll32.exe	28
PID 1728 wrote to memory of 1656	1728	rundll32.exe	28
PID 1728 wrote to memory of 1656	1728	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Libs\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Libs\libEGL.dll,#1
  2⤵
  PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads