249bdaa4332b3e1a3a2148d4fd587a42bd48615af556d1c72da51c55bb2ca697 | Triage

Analysis

max time kernel
89s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
26/04/2024, 19:21

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

346KB
MD5

dccd99cb80c5022d4ed21c068d4e4ae5
SHA1

4fcdc6be313d0e3baa5168a7556df992e3364da4
SHA256

2166f8830bfbf3d574d7654bd927fe6e05fb74fb05d8e57af59c93090f6bc2a6
SHA512

02f18a691d85545a0452631b1c1e218aa5853d71937f7ae1d4f3639142399017139c1d9cb81f769754303635ce689605a7fd65765a3d8b4873603ced57925faf
SSDEEP

6144:DMsJQmSGv9SHEOCK6tNu2JztBwNWqERYRg2Z4uVPZIcwpJAc21Dq2bTm:DmERK6tNVwNWqEnFuVPicAwE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1804	4908	rundll32.exe	80
PID 4908 wrote to memory of 1804	4908	rundll32.exe	80
PID 4908 wrote to memory of 1804	4908	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
  2⤵
  PID:1804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads