f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 23:38

Target
libGLESv2.dll
Size 7.3MB
Sample240510-3msavabb94
SHA256 59133f095f941eb8d6b3613fd08b98e6d84e8290f3f72ded6d98c8683582f188
MD5 b7214621f818dfe440ade5b2f3619519
SHA1 4b95d412e49f2e4c3ce71e10b2d76df3ab63547c
SHA512 d8195862a8d6ca8de5aa4096ce1feabda3f8375279904124e80451ef22d1ae13e4de35487afe36996d0b51edc16c48ddda03c5c2b14f4bd5e465ed48e9e3d29b
SSDEEP 98304:P1oUCZenxr5db94k00Vrqm9CyAI5CckgsOMwACgq:75dukhVJCvwsCxg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3016	3048	rundll32.exe	28
PID 3048 wrote to memory of 3016	3048	rundll32.exe	28
PID 3048 wrote to memory of 3016	3048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3048 -s 88
  2⤵
  PID:3016