952c89e629280ad52d9eba9383941522304e36c0054a523bfb0bb97db2d8c546 | Triage

Analysis

max time kernel
358s
max time network
371s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 14:23

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.4MB
MD5

65fd6bae92477dbc96d15ce28f5a3ebf
SHA1

2111b196e265f9463b5447ea0c831826145b4498
SHA256

a1275f57b47575db9aa3a577e5eacba1d7f1d5578ef6a8072468d788c93c85ff
SHA512

8f9e94839664399a745b8b6f242ebe8d6d0c7490a704a2e7082d7b70384538ea3708937b254cfac5cd2d776b89a0ac34ee09c5744284a9887fedfc3b3e75c49c
SSDEEP

98304:xgBPe7R/ujOL9I6A26IOQRFZ0SEJwwKv77Mo1JaWXm3WtPa:xg1On66A+x0gwU4eCoS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1480	3000	rundll32.exe	28
PID 3000 wrote to memory of 1480	3000	rundll32.exe	28
PID 3000 wrote to memory of 1480	3000	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3000 -s 92
  2⤵
  PID:1480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads