eb71dad7e3c7fc10f128a9f4c1aebdb527eb4192e3525010322559ca9b63d610

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 01:01

Target

libGLESv2.dll
Size

7.6MB
MD5

8c93e19281992a00993fc0f09e272917
SHA1

3a2d12bc85f829775ec8c5c1f8e35a783d37b7a7
SHA256

1ebc1da8d7e463a5d3dc127a632989ef35cfbd94cb18bf1f8ee790f172d43703
SHA512

c4ec65378d83e6645c9128825853de2d3e82c0f430cd28fdc761eaf2d011267c3794b7c1dcef017750323873d7fe976656eebf9ed7c03582741d43738f3e0c7c
SSDEEP

49152:BIgJiNu/CVyS4I+K/UGG7ftgIj4RBrGW+T54vwjKxH33yjsMfRJvLnLBXonnMl9W:mNyUxGDahRNR6gyxQi4Mn0YJ4/qamG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2656	2552	rundll32.exe	14
PID 2552 wrote to memory of 2656	2552	rundll32.exe	14
PID 2552 wrote to memory of 2656	2552	rundll32.exe	14

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2552 -s 88
1⤵
PID:2656

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552