e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864 | Triage

Resubmissions

28-03-2024 09:19

240328-laa3cshc5s 10

28-03-2024 09:13

240328-k6zvxseh67 10

Analysis

max time kernel
32s
max time network
45s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 09:19

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

6.2MB
MD5

7b2ce44ad89a57b1183d36e89fd0357f
SHA1

178f7ed96f5c879b08729acff45bc50cd2ed64c7
SHA256

9072dc08a094f4669e50ac1d062e1e0ee53714eec67a2e7fc0dd2de832239701
SHA512

9d2909023d60564c8ab65cb1668e52b715c37df22bef480e5efa3218b1fad8777acaeae7a17b385e2dda2f3dc0e051ec157ec73b56cef1aff2b8a2281ef7ba41
SSDEEP

98304:FLBnpe7yyxRkfCSC7Kzc2e5+M1E+F+VeNmOeOptkLYhSzchdxPxd:FL9s7TbwCSW2e5+SF+3LYhee

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	5068	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 5068	4112	rundll32.exe	86
PID 4112 wrote to memory of 5068	4112	rundll32.exe	86
PID 4112 wrote to memory of 5068	4112	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 612
    3⤵
    - Program crash
    PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5068 -ip 5068
1⤵
PID:3492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads