42ad279878792b976f051847fc40e8b31fb4a043cc440455fca28b8f9a252271

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 23:42

Target
libGLESv2.dll
Size 7.5MB
Sample240603-3p5c7aec79
SHA256 a8d45aeca2957aae2237665864f9653188962bd5c34f6b806497ddbcf386fc34
MD5 b0d70ba06fbfd4f6a374d9466b9188ec
SHA1 7c7e14f7bfbe4e53c1fd0fe3833a560bd890b823
SHA512 d3500f5d580d69191bcf007e4039cbf0f0d4ff8c11d6cd01f8a22ecb3b73528cf5cbee12881b6a45fbcd130f34cbe10fca75af43a4237144ee2664671a1913dd
SSDEEP 98304:ZYM1bKnyhXV3X4Nf/eW74heor1up6sDCpaXm3TVz:ZL1jlX4F7ivuyUCTVz
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2872	3044	rundll32.exe	28
PID 3044 wrote to memory of 2872	3044	rundll32.exe	28
PID 3044 wrote to memory of 2872	3044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3044 -s 88
  2⤵
  PID:2872