b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 01:07

Target
libGLESv2.dll
Size 7.2MB
Sample240408-bgnxpaca9x
SHA256 ab282c140b24eacf351fedd21a1ddf4ab9f7f2bb8283fa4726c2be814a1eb31f
MD5 7780d8c6e51d729c3e248fefa462a1cf
SHA1 361f9a5d1370730d543ce40c5fd091f57dc432ff
SHA512 5ab8bd42c646f7f9ef075f5cd60c3fac307ff1b7bb17d2c41ddcd0ba6c6ce70c89509ea4c8a84028fa9f9bb1b30c1e5c04d3c716489634ac19a402be2a1ec338
SSDEEP 98304:VBjjY4kRuP2TUT+aRH1/ePJr7f7gsOMtJ:7Yj6xXRoJr7fcsN
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1724	2080	rundll32.exe	28
PID 2080 wrote to memory of 1724	2080	rundll32.exe	28
PID 2080 wrote to memory of 1724	2080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2080 -s 88
  2⤵
  PID:1724