1e260cc632ca007f0d8315c3ad6b12199e4b65c1a79de8223a5558d1c3c6f224 | Triage

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libEGL.dll
Size

314KB
MD5

857260a0224eed87966c22b826b53534
SHA1

20d4126a766bd393d33ccdebd1732fe8e77d77a8
SHA256

1e260cc632ca007f0d8315c3ad6b12199e4b65c1a79de8223a5558d1c3c6f224
SHA512

728ab196d8c5a986fea0ca7314bdc81bda22e0a138c14042c83519ff7206041aee07e9eec3adaa7f27593366ec6050c584173d485050cec74a906166ba4cb8a4
SSDEEP

6144:tsHVY0f3PNlLhkDli3HtngRLxZd9pqYPlZX95zZSUY6ojG8L7r3fts07l:tLU3PJ8fxL9pqMzZZYrTr1s0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2228	1228	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1228	2040	rundll32.exe	28
PID 2040 wrote to memory of 1228	2040	rundll32.exe	28
PID 2040 wrote to memory of 1228	2040	rundll32.exe	28
PID 2040 wrote to memory of 1228	2040	rundll32.exe	28
PID 2040 wrote to memory of 1228	2040	rundll32.exe	28
PID 2040 wrote to memory of 1228	2040	rundll32.exe	28
PID 2040 wrote to memory of 1228	2040	rundll32.exe	28
PID 1228 wrote to memory of 2228	1228	rundll32.exe	29
PID 1228 wrote to memory of 2228	1228	rundll32.exe	29
PID 1228 wrote to memory of 2228	1228	rundll32.exe	29
PID 1228 wrote to memory of 2228	1228	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 220
    3⤵
    - Program crash
    PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads