a4c5f72184b8bb06b6202074d1c81469ea56f74dace70d09fb5c798f85d8b700 | Triage

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 11:53

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.3MB
MD5

596379ba25b32e95b5ec3cd8028b291b
SHA1

af61b5d29db91997e29ffed8a410d09ce74ee51e
SHA256

d5e1d7b8531a0f4ab576ba6f78d4c63b39186a2830d313c6695f0024c9ef627a
SHA512

f8835b455820c77b4ba509c326a185bf65131242161498229c5e3584a0e7789324932b95678556a657440deaf067ead454e85bf8233efa24162e7e4d9eaf417b
SSDEEP

98304:AwY1sQqaLe2Egto8U4r5Pp6TlITQZ38W888888888tb8dii:vNaSgtvroZ8

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1940	2392	rundll32.exe	28
PID 2392 wrote to memory of 1940	2392	rundll32.exe	28
PID 2392 wrote to memory of 1940	2392	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2392 -s 88
  2⤵
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads