cdd9213c986f4dcc1f2c07f584d564c6a3ba00c9c27fe016bf51fd70ff0ef973 | Triage

Analysis

max time kernel
148s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 23:01

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

5.2MB
MD5

efbc15503d95a27aedda0c21efc63f6d
SHA1

9c293cf5ef014075941c756c26046da797da1013
SHA256

f30b524700a003f73ad35c0ad3495b641531b74ba06fb972e5a59bf4ea453a39
SHA512

5c0bb7d2f1a14ec148b1721b2e57d486328f3539e76a6ec0e5ce0b1b742bdde7aa102e46ac1529124b7a8ad9ab6137e64f7bf0aa146571091b9b05a2e02c9254
SSDEEP

98304:hyHvU6gTY6Y9zIreEkjvTDIEsBwBdu/mCVUYh2dOQu2pfMpZw3a:hyHF8hYZIrepIEsQkWYh2dlpq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4432	3496	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 3496	2188	rundll32.exe	83
PID 2188 wrote to memory of 3496	2188	rundll32.exe	83
PID 2188 wrote to memory of 3496	2188	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 612
    3⤵
    - Program crash
    PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3496 -ip 3496
1⤵
PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads