d847b98ee4ccdadf0a406fa42cac1de6132ed595bc3986c54e22a1b46e178aaa | Triage

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 10:45

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.5MB
MD5

46cb552ac7fef22fa1f610b7fa3d3feb
SHA1

d40559b1d09ecd7da5c1fff459dc06bf64bad3c5
SHA256

90b9f900cdceb04a9a5d1fd124e7b4f424c15cdc12e8d340f26b7eefc8238ce9
SHA512

e6a61b657c5033bacf464f2b585bbf6247b7efa7cee3fe343b6ec3adfa8644b4a6d2c0125824c935d7944d5b445a9d2f1a6c7ba6d72be7cf626b6b75e663ca9d
SSDEEP

98304:2YM1bKnyhXV3X4Nf/eW74heor1up6sDCpaXm3TV4:2L1jlX4F7ivuyUCTV4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1696	2052	rundll32.exe	28
PID 2052 wrote to memory of 1696	2052	rundll32.exe	28
PID 2052 wrote to memory of 1696	2052	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2052 -s 92
  2⤵
  PID:1696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads