249bdaa4332b3e1a3a2148d4fd587a42bd48615af556d1c72da51c55bb2ca697 | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 17:27 UTC

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

346KB
MD5

dccd99cb80c5022d4ed21c068d4e4ae5
SHA1

4fcdc6be313d0e3baa5168a7556df992e3364da4
SHA256

2166f8830bfbf3d574d7654bd927fe6e05fb74fb05d8e57af59c93090f6bc2a6
SHA512

02f18a691d85545a0452631b1c1e218aa5853d71937f7ae1d4f3639142399017139c1d9cb81f769754303635ce689605a7fd65765a3d8b4873603ced57925faf
SSDEEP

6144:DMsJQmSGv9SHEOCK6tNu2JztBwNWqERYRg2Z4uVPZIcwpJAc21Dq2bTm:DmERK6tNVwNWqEnFuVPicAwE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28
PID 3064 wrote to memory of 2944	3064	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
  2⤵
  PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads