4c736d1faacebb84bd437e13ebf1d1c0d615e1aabe55a0444d5d290a9e8d5c7c | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 21:33

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

6.6MB
MD5

b2582f122378246e885b25598bb64e23
SHA1

3684b220541bb85425d51ad0c86485fb358230a9
SHA256

0c99dac71f32760346ac4ff628066339eea6f0e79e9d5e5387af13be0fbf5dfb
SHA512

9122bdf562b649ad41f4903fe9981170fa43ced2e724bc60434645ceedcddddc393cbafa7a7b4143ce0b0d3a664c5d135a15cd3bdde2e6175b9d611158366ce2
SSDEEP

98304:cQjdYjiujJ/LcrF9ksM3+kBvJI7sW61LrFpLCCU7ZIIEOb+t:cQj9AzE/5knIQW61DCdaIdb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4520 3712 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2108 wrote to memory of 3712	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3712	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 3712	2108	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
2⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 612
3⤵
- Program crash
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3712 -ip 3712
1⤵
PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads