16b5587f8d80e75cb742c9109217da9a6c7031e0fb7a5f9e1b4ca7861c0ef88f | Triage

Resubmissions

14/01/2024, 18:04

240114-wnrmdadaf9 9

14/01/2024, 17:02

240114-vj54jacgh6 7

Analysis

max time kernel
423s
max time network
447s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/01/2024, 18:04

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

6.4MB
MD5

0dd9d071091ed406ce1b3dc7531588da
SHA1

f8bb5911bc7d3a8a501dcb5e49b77e5d18ba76f4
SHA256

695fa7a6a1a53590267519497c1a5597faf844136164c6438c6a849ad12b6542
SHA512

2b26d0792252a4b5c90e573ac11c1ccaa1362a4c4f5b6c6b6cddb7a46870e9b2fcd209932e48061a7e9cb4a43d074c0454986d59f8b87d23ed2f2a31a6666878
SSDEEP

196608:WnAdzwsaMImy3KOJVcZGpSCjh5dxyomGk:Rp1aM1y3KOJVcZGpVtNyomv

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4372	3912	WerFault.exe	38

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 3912	4456	rundll32.exe	38
PID 4456 wrote to memory of 3912	4456	rundll32.exe	38
PID 4456 wrote to memory of 3912	4456	rundll32.exe	38

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
  2⤵
  PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 612
    3⤵
    - Program crash
    PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3912 -ip 3912
1⤵
PID:3156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads