a2d4c19d2a8c9a6a196ebcf1f49a6eed03b06b76880d772fa8c0ab72aec59763

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 20:48

Target

libGLESv2.dll
Size

6.8MB
MD5

f96fc251bae55a5fc0f1ddaed8706015
SHA1

532c2b51f5e3256777ae3b9f40c8067b20eee0a2
SHA256

7897eb2441975523e3e78dbeabf2d9deba66534c69b6cefbf87ea638ee641ea6
SHA512

cf2f9f126204596e37bbe5517500a738ad06f306cb49e7a36bc050e38a61191a767e5d3fecd570410f08d67b64e77019101b2970867e8f0d41b35a6526d3d280
SSDEEP

49152:BVjYuYQiOJYXEPdX++aEVQwXW0LXoJihD9BV1W6X+AIt8k9C3NRKRzDGYCvktcKx:fd++tVQeWQhUkkKIGLJWr/bm

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2392 wrote to memory of 2400	2392	rundll32.exe	28
PID 2392 wrote to memory of 2400	2392	rundll32.exe	28
PID 2392 wrote to memory of 2400	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2392 -s 88
  2⤵
  PID:2400