b16b2bb2cf65357f42f046e187a668cc9ddaf564f0d14e766b55404be97c9686 | Triage

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 04:52

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

349KB
MD5

7e35d1330c61c7b10297ab72b9c8d288
SHA1

c316219d90e6c2f36d527ee371ecc9d56d65ba61
SHA256

57a05771715aab49605c9216bc6a011bb12043afd59e676cf86c449ba89d65f7
SHA512

6a75894ad5ac21f4733cb10a3a8b33dd0b77859248d71042a933adb1932342fdbac18751d3f56fc4fb77493e6659c3f9fd33079c8d255a7cc4ae5e2397433718
SSDEEP

6144:FEYlqgyp/a1fn9F3bsyy/0oTv1eqMuQ/4RQpV5+eMHm+Xi8:FEYlryp/M3bsyyb7SuQ/WQJ0h

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1928 wrote to memory of 3868	1928	rundll32.exe	rundll32.exe
PID 1928 wrote to memory of 3868	1928	rundll32.exe	rundll32.exe
PID 1928 wrote to memory of 3868	1928	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
2⤵
PID:3868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads