b931be51f58aefde0a308963de518204d7ea7422b752ddbd96d22119516d0d47

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 20:37

Target

libEGL.dll
Size

348KB
MD5

985125118e135a027cf98c189281fccc
SHA1

5eac86608875e127810b02122c5a7d8aa258c233
SHA256

f156ca816c7bcfef973b16c745afb472173366f9eef015176ac3c5d6cb698639
SHA512

439591c75f909a633f8534bfca39b2ec9c20e181b6fcca2a927dde2108d3d8317732369cfe04c1296b43dd3f60a0c191947ecfc5da33586c63a03b932e8fe614
SSDEEP

6144:ReMWV0vGisRRDwaHZNHHmtCZa29BeyyAYrhsV6fnrHZhGHJQCBf/QxX7Rlk4SEMz:sMWV0vGisRRDhHLHHmtCZauBeyyrfr5Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1640 wrote to memory of 1896	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1896	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1896	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1896	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1896	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1896	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 1896	1640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
2⤵
PID:1896