e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864 | Triage

Resubmissions

28-03-2024 09:19

240328-laa3cshc5s 10

28-03-2024 09:13

240328-k6zvxseh67 10

Analysis

max time kernel
40s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 09:19

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

367KB
MD5

5c70cc094fc6e108a5689c88f1144a51
SHA1

460b668e4301e774b79b182756db25fb0b7c206e
SHA256

c99a051b9d73bc638d593561ea7ed499db689420b51d5945a618579a26cb0b42
SHA512

3943bb1bbbe683a4d2a43609d78dec9b70b58f542f88aa783080732201650b38bd0a3e6936439cfadc211c51512da9680999d6e4f7deb077096988b6878124e7
SSDEEP

6144:Z5Qt2a1DtgDNyJlwMwds3hFQMHkx95NdD0OITw+Knb:Ut2a15ghivwds3fSb5rIS+E

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28
PID 3000 wrote to memory of 868	3000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
  2⤵
  PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads