05451b195a176fa75fb7a8de600068e1f08b2a0b5cef42eef8439ec28ed26a59 | Triage

Resubmissions

27/04/2024, 19:36

240427-ybnfasfc9t 7

27/04/2024, 19:12

240427-xwpy7afb2v 7

27/04/2024, 18:20

240427-wy4ppaed6x 7

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 18:20

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.3MB
MD5

cba2436016f7a2838588a52d5b6f30f1
SHA1

81ddf44b3e122dfbee1a2cd8d4544364f1a621a4
SHA256

bcb3a3d2fca3c33fa3d1d5dc976aa913cdc8001df8e64c2cd3d2c545245141bf
SHA512

d92a880b5f83c5ae10ae9a83e38a293bb0e8c7659dd6ece162fc752d57c9fcde8036b81b023cd9f0f4f32b95b06fd4c366e20301010354b6cb904398a3149a44
SSDEEP

98304:U8qvGdDtslh+LD3ZDWfnSvBSDU5bPm3k89Ld3gsOMt/:JD3ZXJ7bPWLWsD/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2408	1848	rundll32.exe	28
PID 1848 wrote to memory of 2408	1848	rundll32.exe	28
PID 1848 wrote to memory of 2408	1848	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1848 -s 88
  2⤵
  PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads