b16b2bb2cf65357f42f046e187a668cc9ddaf564f0d14e766b55404be97c9686 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 04:52

Sharing

Report Analysis Logs

General

Target

swiftshader/libEGL.dll
Size

364KB
MD5

ada28d65fe2147e1e5ef2c2cec1f5e21
SHA1

a7f73548a44eecb51e829ef4f4c522ed9cb0cc95
SHA256

294d9dc33f50270cf794397c9436e30444a94e31e0d72825d0e471a000ab1bfd
SHA512

1bd37791755d3c15573a613979a75e8aa6267331c9b3581231ceb3123efb687d8c8622dc90489ec4b879f01feed9a13de2a6fe79ed193197b2ae415d554f262b
SSDEEP

6144:34vgaNrFwjONtiVw4LVxz3jbIHupKDdheV+FE+liQSsI4:34vgcrWONtiVxQupKJht

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2820 wrote to memory of 1732	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1732	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1732	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1732	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1732	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1732	2820	rundll32.exe	rundll32.exe
PID 2820 wrote to memory of 1732	2820	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
2⤵
PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads