c92a121ec9829988f3b22328470df3d548f03a3970335694b50206676afaeb7e

Analysis

max time kernel
19s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 07:36

Target

publish/av_libglesv2.dll
Size

4.2MB
MD5

73d2fb4c35d323813a86e3bf5c85c345
SHA1

81f751a34e0c25bdea93902a19a94a49ce1495df
SHA256

85b3aee47c0e0eaf3a5ea5c75ba8131387a12639b6a0ef280c28531fb77695ae
SHA512

e81677cc9b99ff3d54f67000a60489603e01a896f90c4ef0c883b82e2fdb7b90d2899c078958b3f060a20373b99cb6c4deb7f64cc4c7e0ba2a708209f4684ca4
SSDEEP

49152:I1qISHMa72SRXc0kFg760EvAy4U5hDempTKkslMx0YEQtHhcEIy/rcgcrq8T/2tj:vbMNgMdth1t

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2736	2988	rundll32.exe	28
PID 2988 wrote to memory of 2736	2988	rundll32.exe	28
PID 2988 wrote to memory of 2736	2988	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\av_libglesv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2988 -s 92
  2⤵
  PID:2736