ffaa6ae5e499945093a6fe2a7a05504f8796127cd6f4de239b47a7e86715214c | Triage

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 06:06

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.3MB
MD5

bc45db0195aa369cc3c572e4e9eefc7e
SHA1

b880ca4933656be52f027028af5ef8a3b7e07e97
SHA256

a81729fd6ee2d64dfc47501a1d53794cdeee5c1daa3751f7554aea2503686d10
SHA512

dd8c39947e7d767fbdccf90c5b3eaedf3937b43c55200d2199107333b63ac09e5356c286618874fac841e1357dd927e0c70b5066c1feeedd8cc6c0fba605ee5f
SSDEEP

98304:txhV5ahd7dNgHB1g468F4p9+7ULjSLy+W:tDVEhd7dcFE9+kSLx

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2304 wrote to memory of 3020	2304	rundll32.exe	WerFault.exe
PID 2304 wrote to memory of 3020	2304	rundll32.exe	WerFault.exe
PID 2304 wrote to memory of 3020	2304	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2304 -s 92
  2⤵
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads