8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e

Analysis

max time kernel
207s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16/04/2024, 19:36

Target

libGLESv2.dll
Size

6.3MB
MD5

5a3d6c2e4c8b1a0c663710e075aba135
SHA1

b81ffaf3979bdafb3fb12abac00df88bfa21bc03
SHA256

2647f7adf5b294ace3934a0f096f815e7292de7311ac8ceb064d03ca1c8487fd
SHA512

8e8431afa8e18811be659a1a5e73217da6e3bf6667beedb5ed85a8b57d76fca2eef0df8440c9678807a6e9bcb49fb81a2bd805f6d2857e834fa9f07d3be095d5
SSDEEP

98304:U2z+7RIskSWkNRxsgO1rH4Ju6hBNWQzl/Le2ZaOPeNilZWFYy5VhY8ShBNp6/Uh1:Rz+7ErHYu6BHlTHeiXun5UNwhha

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4752	1456	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1456	3060	rundll32.exe	81
PID 3060 wrote to memory of 1456	3060	rundll32.exe	81
PID 3060 wrote to memory of 1456	3060	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 464
    3⤵
    - Program crash
    PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1456 -ip 1456
1⤵
PID:1800