b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2 | Triage

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 18:28

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.2MB
MD5

7780d8c6e51d729c3e248fefa462a1cf
SHA1

361f9a5d1370730d543ce40c5fd091f57dc432ff
SHA256

ab282c140b24eacf351fedd21a1ddf4ab9f7f2bb8283fa4726c2be814a1eb31f
SHA512

5ab8bd42c646f7f9ef075f5cd60c3fac307ff1b7bb17d2c41ddcd0ba6c6ce70c89509ea4c8a84028fa9f9bb1b30c1e5c04d3c716489634ac19a402be2a1ec338
SSDEEP

98304:VBjjY4kRuP2TUT+aRH1/ePJr7f7gsOMtJ:7Yj6xXRoJr7fcsN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2112	2928	rundll32.exe	28
PID 2928 wrote to memory of 2112	2928	rundll32.exe	28
PID 2928 wrote to memory of 2112	2928	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2928 -s 92
  2⤵
  PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads