e8784b21f05c7f91ae6082ae912ddefddf62bccf717c2a9f649f147eb28eadbb | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 18:15

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.5MB
MD5

2718694e3a8b2ba7ac7ef71c7a0ef4aa
SHA1

7ba04084be9d853c7c4f835a7f714425794c3523
SHA256

ae39ba9c938a17b90445fdaaa184e710ea405e21784a6cc9caa10320a49c6cfd
SHA512

2e1594506ecd3035f31e134eaa2eeb1d98b12f0917f0dd153bbb8a6931d4438bdaae7d96770c1c1aeef9af4bfaae3af524fb9ea6c2f785530f579d12d70256dc
SSDEEP

98304:qYM1bKnyhXV3X4Nf/eW74heor1up6sDCpaXm3TVZ:qL1jlX4F7ivuyUCTVZ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2580	2932	rundll32.exe	28
PID 2932 wrote to memory of 2580	2932	rundll32.exe	28
PID 2932 wrote to memory of 2580	2932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2932 -s 88
  2⤵
  PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads