271de5aed87a398dedf889c16d7927e90f07facb4774a073cd4f365073fe51f8 | Triage

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-it
resource tags

arch:x64arch:x86image:win7-20240221-itlocale:it-itos:windows7-x64systemwindows
submitted
05-03-2024 14:02

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

338KB
MD5

af6891818b6a66b7c18926d297409324
SHA1

e3e4de4cf2bc57565a1199c0e0ca9a9555db864e
SHA256

c0b349effc64971df76975aa2f662d4c3b30aea7193aac5095728174c5428852
SHA512

b9c98e54c1fc559b9ca1378337658620b5ae89bd1d677b10af1ddc7a86a870144d5010945b3054abd9da7b6f123dd22890f71590fd5076474b5745ddc82f0b50
SSDEEP

6144:4tEh7IlyUXhM3FLzcHGQcmZGyYGRSkvY3fzJnwSwbFPWjZGaBcPPv8K:4m+lyGcmIyYGpvY3fzCaZlc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2504	2252	rundll32.exe	28
PID 2252 wrote to memory of 2504	2252	rundll32.exe	28
PID 2252 wrote to memory of 2504	2252	rundll32.exe	28
PID 2252 wrote to memory of 2504	2252	rundll32.exe	28
PID 2252 wrote to memory of 2504	2252	rundll32.exe	28
PID 2252 wrote to memory of 2504	2252	rundll32.exe	28
PID 2252 wrote to memory of 2504	2252	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
  2⤵
  PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads