a89e65bc9d8ff21e1381de737e03a3325824f173d4bb306d92ece6c54d1c5884

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 15:48

Target

libGLESv2.dll
Size

7.5MB
MD5

640a515fcd8e5d5a332c1d40c47700b0
SHA1

0128c9d499deb7866f3d7aae0adab69d9a8f768f
SHA256

927c858deb4700d3759fab436d5ba554ff4cf7be505d536ea1c673707d5ca8a1
SHA512

792acebb5ba329e61bc319b415ba01248dcf18c7e46695222682dbf59d179403ced15c19ae03a282dec7e622121c05844d8eae5a04a2aa1f552ebced51644e27
SSDEEP

49152:cHYVf3vXozSZVwq1ZET78U9t9Ib7P4jN0gVkel0hZecqjXFArFFiKMTvrd5/Lln+:DWD0Ue/elpegxsgPRPV+fJJ7od0m

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1952	1176	rundll32.exe	28
PID 1176 wrote to memory of 1952	1176	rundll32.exe	28
PID 1176 wrote to memory of 1952	1176	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1176 -s 92
  2⤵
  PID:1952