6f89de2ae773d9d0823f407572017c7dea50d8b28c7140cfcb9232293150b9b7

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 18:24

Target
libGLESv2.dll
Size 7.1MB
Sample240213-w2b4vaeh8y
SHA256 2404be88c798b43499ab7466e2b04bd58510f0d3fa59049aba6ffb932b65c977
MD5 eb2b911d33f5ba82109a0d5608c28334
SHA1 fbc578fbcfc88a132438b38e97bb87c16a9f698f
SHA512 19becd2003702813898893f7b1fcd1db179a76fbd201fe34471254b75ba5e98af262922adafe5ef0672302cdf4c0b1e2f8910fd2e51ded0f3c4d6c5a43de489e
SSDEEP 49152:Nk6rcYCLRRdx7IXvR7vjyhUpSOIpgRcbSIXv9RPKSNtc1OAE3tg5qHqwfuXBMwrE:ZYjEXvRhpS7X7T90VSJAxtLNSg1Sd
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2408	2372	rundll32.exe	28
PID 2372 wrote to memory of 2408	2372	rundll32.exe	28
PID 2372 wrote to memory of 2408	2372	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2372 -s 92
  2⤵
  PID:2408