808ccd81cbb014df3475fa04ffc0fae33470a6d2279052dce33349f208558100 | Triage

Analysis

max time kernel
135s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 03:24

Sharing

Report Analysis Logs

General

Target

GLES_CM.dll
Size

916KB
MD5

1b8725b6af088a6dbf01d856f272ce4e
SHA1

1eb4a2e1ef9ec8802ede95f4f4f65b416ff59466
SHA256

a3676decd98981b7871e5eb8bec62838c08031ee652fe24ad203a854b3da5929
SHA512

cf6d0864dcd9fb29e741d1ed225b4b4834c47a60f6c32fb238455fbf15bb362f58dfded927b83e7fefb7e13b2be7a333dad0cef7166989dbc57a9b0dcd26176c
SSDEEP

12288:q5hYGjb2ieK9/vX4b8oV9IiDh9kP/3LSjVv:IhYGjb2ieK9/AooHIiV9eGR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3200	228	rundll32.exe	83
PID 228 wrote to memory of 3200	228	rundll32.exe	83
PID 228 wrote to memory of 3200	228	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GLES_CM.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GLES_CM.dll,#1
  2⤵
  PID:3200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads