593c83930d6f0ca5e300b1728ed0a793d71ade9bbf3ab5ca6a4c38769c093a36

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 04:03

Target

libGLESv2.dll
Size

7.2MB
MD5

60e42e83b260582fc96aaf43293d99e1
SHA1

c548a10873f9a57e18c7fbb1fe89685f4cf1ba84
SHA256

25d49934fc220b169cadeb21fc99dc2a8fb1dd5a4f244265799392f0f5f2f8f8
SHA512

6a905e2b9427fb6e4a53080afdc2ae9dc32c54aab5460f88f7d3fd16e7e9a841d332057f58942d54defe91361a54d3cbedba295399cead754f353f80f92f238b
SSDEEP

49152:Rs95E5fqF3q/xEpLJgw7yQj1+lSWsucneTA4fwEmN428bbvbgNqay6q/iyGtxJe5:2lq3ZieHhogDbBztUecv7r7frgsOMG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2180 wrote to memory of 2392	2180	rundll32.exe	WerFault.exe
PID 2180 wrote to memory of 2392	2180	rundll32.exe	WerFault.exe
PID 2180 wrote to memory of 2392	2180	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2180 -s 88
2⤵
PID:2392