d38241aaa6308ef9f79ca6ba87b8f903fd4aa2f44307a45076d0c244fb5c544c

Analysis

max time kernel
133s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 11:30

Target

libGLESv2.dll
Size

7.1MB
MD5

c1e0443d85058c155018cbfcfd4c05d4
SHA1

6db97d09450141df2bc3da1722e6fcf7edc4c35d
SHA256

f5773168236c190fa8672ecf4a79e4b93bc36751b65631c1fb4e1ab981e3c681
SHA512

4cfffb6c0cee6f692a27698ce9824d498e0d3f5327306b715d90d47f19a62b0f10f9b395c6dc6a7178ec5c5b260dd25d45a5caaefc487167044ad5f6b81aa1fe
SSDEEP

49152:YP2P6prqIbd3ekUww7fIW3VAlUBrFiAj0or6p5VvnFVybvjUPJ9bKGD1xwiD1fnd:OeuCV/DepF+8nqDgvaCFjlOiMq

Score

1^/10

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 4512	4868	rundll32.exe	96
PID 4868 wrote to memory of 4512	4868	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4868 -s 340
  2⤵
  PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4580