e66fd24e29c4cd33772fbda049a4efc7b55a0c22959d0d56d0fa77bd34040864 | Triage

Analysis

max time kernel
113s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 14:39

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

367KB
MD5

5c70cc094fc6e108a5689c88f1144a51
SHA1

460b668e4301e774b79b182756db25fb0b7c206e
SHA256

c99a051b9d73bc638d593561ea7ed499db689420b51d5945a618579a26cb0b42
SHA512

3943bb1bbbe683a4d2a43609d78dec9b70b58f542f88aa783080732201650b38bd0a3e6936439cfadc211c51512da9680999d6e4f7deb077096988b6878124e7
SSDEEP

6144:Z5Qt2a1DtgDNyJlwMwds3hFQMHkx95NdD0OITw+Knb:Ut2a15ghivwds3fSb5rIS+E

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 3564	2468	rundll32.exe	92
PID 2468 wrote to memory of 3564	2468	rundll32.exe	92
PID 2468 wrote to memory of 3564	2468	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
  2⤵
  PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:8
1⤵
PID:1296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads