4aab20889fea1250ebff86fd28bebdaa19cc310c496bcddcfdf2d3db56387a3c

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/02/2024, 15:17

Target
libGLESv2.dll
Size 6.7MB
Sample240226-sn7rtahc33
SHA256 a625556d7ae102281b64dfc51834acfd9fcfb95ce74b14fe11de16858f3ca777
MD5 b3d457dc8f345462df1af040be17fc8c
SHA1 ec1f695de07c5999118324dcfb50c5ebc27a0de4
SHA512 5ba2d4a174cbba623deee2c9a95f649e11cba8434d1e0107f195bbda7016bce6efed6f1786beca287052a8d6910e02f82a2300f1ebd422e72e3ab894fc06a1d1
SSDEEP 98304:fqn60kawGdI/T22k88JH4rqg11Rou0LIPrNsYZ/OR5C:fqn605IL2F8CFWDgwBmTC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2220	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 328 wrote to memory of 2220	328	rundll32.exe	28
PID 2220 wrote to memory of 2224	2220	rundll32.exe	29
PID 2220 wrote to memory of 2224	2220	rundll32.exe	29
PID 2220 wrote to memory of 2224	2220	rundll32.exe	29
PID 2220 wrote to memory of 2224	2220	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 220
    3⤵
    - Program crash
    PID:2224