0577b7e8c6a4d394e8be1eff342905b2f2c08490835716bd44e8e5158a3d7149

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 21:10

Target

libGLESv2.dll
Size

6.7MB
MD5

5300049a47fd88310ef94f9e37eeb247
SHA1

89672d16382a75781eeca002c850c17cfc46e851
SHA256

33863ea4047e4eaae8f24bfa3491bb809d4c3d44489ae2bbe5e3af9e5cc1fe50
SHA512

b38ef83cb40923654ae1efcdb8af63e1fb47f640a0cbeac350b97f24da1365da23d757cacef1f9e994ace0b076b4bc1408644347aec3c94995bb27d184a93c09
SSDEEP

49152:sK2UPH7xqUcXJQ/jprR9tf3NPj3O92E+hvk3aOosZPYkZXup70MUgSgcS87ExQhV:UUcXJ8950X+KS5nUSoPYirbm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2080 wrote to memory of 2028	2080	rundll32.exe	28
PID 2080 wrote to memory of 2028	2080	rundll32.exe	28
PID 2080 wrote to memory of 2028	2080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2080 -s 88
  2⤵
  PID:2028