d38241aaa6308ef9f79ca6ba87b8f903fd4aa2f44307a45076d0c244fb5c544c

Analysis

max time kernel
120s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 11:30

Target

libGLESv2.dll
Size

7.1MB
MD5

c1e0443d85058c155018cbfcfd4c05d4
SHA1

6db97d09450141df2bc3da1722e6fcf7edc4c35d
SHA256

f5773168236c190fa8672ecf4a79e4b93bc36751b65631c1fb4e1ab981e3c681
SHA512

4cfffb6c0cee6f692a27698ce9824d498e0d3f5327306b715d90d47f19a62b0f10f9b395c6dc6a7178ec5c5b260dd25d45a5caaefc487167044ad5f6b81aa1fe
SSDEEP

49152:YP2P6prqIbd3ekUww7fIW3VAlUBrFiAj0or6p5VvnFVybvjUPJ9bKGD1xwiD1fnd:OeuCV/DepF+8nqDgvaCFjlOiMq

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2628	2616	rundll32.exe	30
PID 2616 wrote to memory of 2628	2616	rundll32.exe	30
PID 2616 wrote to memory of 2628	2616	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2616 -s 92
  2⤵
  PID:2628