249bdaa4332b3e1a3a2148d4fd587a42bd48615af556d1c72da51c55bb2ca697 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:44

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

346KB
MD5

dccd99cb80c5022d4ed21c068d4e4ae5
SHA1

4fcdc6be313d0e3baa5168a7556df992e3364da4
SHA256

2166f8830bfbf3d574d7654bd927fe6e05fb74fb05d8e57af59c93090f6bc2a6
SHA512

02f18a691d85545a0452631b1c1e218aa5853d71937f7ae1d4f3639142399017139c1d9cb81f769754303635ce689605a7fd65765a3d8b4873603ced57925faf
SSDEEP

6144:DMsJQmSGv9SHEOCK6tNu2JztBwNWqERYRg2Z4uVPZIcwpJAc21Dq2bTm:DmERK6tNVwNWqEnFuVPicAwE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2416 wrote to memory of 1956	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 1956	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 1956	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 1956	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 1956	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 1956	2416	rundll32.exe	rundll32.exe
PID 2416 wrote to memory of 1956	2416	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
2⤵
PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads