e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864 | Triage

Analysis

max time kernel
138s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 11:44

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

6.2MB
MD5

7b2ce44ad89a57b1183d36e89fd0357f
SHA1

178f7ed96f5c879b08729acff45bc50cd2ed64c7
SHA256

9072dc08a094f4669e50ac1d062e1e0ee53714eec67a2e7fc0dd2de832239701
SHA512

9d2909023d60564c8ab65cb1668e52b715c37df22bef480e5efa3218b1fad8777acaeae7a17b385e2dda2f3dc0e051ec157ec73b56cef1aff2b8a2281ef7ba41
SSDEEP

98304:FLBnpe7yyxRkfCSC7Kzc2e5+M1E+F+VeNmOeOptkLYhSzchdxPxd:FL9s7TbwCSW2e5+SF+3LYhee

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2700	2560	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 2560	3640	rundll32.exe	89
PID 3640 wrote to memory of 2560	3640	rundll32.exe	89
PID 3640 wrote to memory of 2560	3640	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
  2⤵
  PID:2560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 612
    3⤵
    - Program crash
    PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2560 -ip 2560
1⤵
PID:4512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads