90fd17cf8603ce14ef8e537d020bbe360bd1f856028da7cff94abbc76203a7ff

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 15:03

Target
libGLESv2.dll
Size 7.2MB
Sample240608-se57macf91
SHA256 6190498b331769f86428a828c95a2bbf7cd9424825114293725adaa1e761f864
MD5 8a4e0c0101767abcc4cf9283589789ea
SHA1 8b7f107c0494460f19cc7546089c3d91865bb8d0
SHA512 191e1e49ed39a15a84945094e23f1b142f349d2c9fd00fb40299437be3a080686ce4da1af0ad270b37c56901cb2d0ecc842df25d1e2fbb3a0d36b785350b1838
SSDEEP 98304:MpHkfpqDftdyDs21Oyv8VrbXIffVkoXSmkgsOMid:MlkmTyDSVPYffcKsId
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2820	2060	rundll32.exe	28
PID 2060 wrote to memory of 2820	2060	rundll32.exe	28
PID 2060 wrote to memory of 2820	2060	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2060 -s 88
  2⤵
  PID:2820