f07bf397abd8b6bed01b838c3f332319c997f810ee5ec5087e761f1ccc39641a | Triage

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 01:15

Sharing

Report Analysis Logs

General

Target

Libs/libEGL.dll
Size

258KB
MD5

3abaa006e1842b5a3cbed2a41476cae8
SHA1

717f3cf9e7c07073f41841cd7fa9858b76265b33
SHA256

a96cdb651c862120489b30b40a716c3f20b772ac4ba8fc70aaccbb1a568005f2
SHA512

84fa2bf370797c7ad2e63287b6e4bb785a88871830ad261ae38afb05cf8bac574f68539bdc0327c3c254a49e52c7da28bc0ee748db99b2f82ca86b08d9f18735
SSDEEP

6144:O1w9H8OGFO/vqX/PSOW8ijs9z6Y1gpAOs+4uL68:O1aUFO/vqX/Pz2sb1gpjzv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4180	3204	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 3204	4456	rundll32.exe	17
PID 4456 wrote to memory of 3204	4456	rundll32.exe	17
PID 4456 wrote to memory of 3204	4456	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Libs\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Libs\libEGL.dll,#1
  2⤵
  PID:3204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 604
    3⤵
    - Program crash
    PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3204 -ip 3204
1⤵
PID:3632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads