16b5587f8d80e75cb742c9109217da9a6c7031e0fb7a5f9e1b4ca7861c0ef88f | Triage

Resubmissions

14/01/2024, 18:04

240114-wnrmdadaf9 9

14/01/2024, 17:02

240114-vj54jacgh6 7

Analysis

max time kernel
521s
max time network
549s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 18:04

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

374KB
MD5

e178a372d2b5dbbb1208eb3c0da0e1dc
SHA1

609afbe408408aa8bf8d485d33a9b99ae829f042
SHA256

493d9749bd5e0080900faf2806a43818971789312a40708eb68494b1f12adb57
SHA512

a9ec9d4371dd13bcb8428a415d21a236bd24b71a3fece9677aa7e256e75feb23f0c6b1dc88cd223e345f806cac9145c7266436694488c105d4c0c2f4542c6f82
SSDEEP

6144:iUtJWbMdDsBJg/HaHjrdUErV1dOPZ2TtACWquwKKeh4:iqWQR6HjrdUMV1dzOC2wKt

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 4532	2976	rundll32.exe	90
PID 2976 wrote to memory of 4532	2976	rundll32.exe	90
PID 2976 wrote to memory of 4532	2976	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
  2⤵
  PID:4532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads