6d192fbf295a7505ae7fdb872f12465b79931c7284ab21bc493bc3a118ae844b

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 14:38

Target

obs-plugins/64bit/libGLESv2.dll
Size

6.2MB
MD5

30bb883e79514875d7a6d1134612347a
SHA1

f7b0555affaa47e0a86732561595913f8cbf2ca2
SHA256

d09f4379828a0487a6af24dad7cc8ec68b03bdf5a094067f609db5adc8efa44c
SHA512

a7d45c219e89672a33d6fd629c8f6003e419dfae6ce9fb86c1fe11ce244724ff65df6b7ddc8360b0e47c2f14ec167261933f3c4908ffe43cdbce4d62977101b9
SSDEEP

49152:ZIr6m257PMPb04nJGowmHlQQCIkHKxf1xvOGdlJUqkAY6rwT9a5czej/B4RrbhW:V+sDq2+lEsKizqcGss8+1K

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 1716	1312	rundll32.exe	28
PID 1312 wrote to memory of 1716	1312	rundll32.exe	28
PID 1312 wrote to memory of 1716	1312	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\obs-plugins\64bit\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1312 -s 92
  2⤵
  PID:1716