a89e65bc9d8ff21e1381de737e03a3325824f173d4bb306d92ece6c54d1c5884 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 15:48

Sharing

Report Analysis Logs

General

Target

settings/libEGL.dll
Size

382KB
MD5

2bb37aae4eec265d97aea03800a26145
SHA1

06542423b68110c3d5ecf2159114f4c0bc2879b9
SHA256

4a34a80415a041caa00456fcbcfa24cbe8a05d699c8cc302215823826e94bc54
SHA512

66d6307e2a412aadc731bbfe0d96cad3f0aace100de0f7cba970438f7cc8087b8c6a5ac205809622e58d46b92f43da7b213a4713885ae247a1a229e8abf4125a
SSDEEP

6144:5fn91PNKeDQhPAybcKwtN0eHpN5uv4XdWT9V:5fn91PDDQhPRNkN5uv0W3

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1792	1924	rundll32.exe	28
PID 1924 wrote to memory of 1792	1924	rundll32.exe	28
PID 1924 wrote to memory of 1792	1924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\settings\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1924 -s 80
  2⤵
  PID:1792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads