73afa2c6f03988437e110378a01663641ce68389145da4eb64237cbdf00d3468

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 21:03

Target

mmpack/App/imageformats/dll/libGLESv2.dll
Size

2.3MB
MD5

23b8f6b1f7c2b3259553b146fb595c22
SHA1

5e3e0821ffcccc3eb6bc3391bcb9ba569814a3ad
SHA256

70cf3c6ed01b79764d4cbea68abbf3118c768eb766f764f614655fa9aa22ae66
SHA512

f4be1b8f3ce0ae33b93bb61a2497e8a9bed11d3a8c3aa31bae7eff893ca8e244237266791bb6e965895fe391525f2fe192d9efcea9bf0dea04e22a4794a09465
SSDEEP

49152:KRXsEpznERd0qHcuRGzpiLEa1u1bbJ2W9PKCaY8FNfRpkYkRgatde7/LKT0AMFJO:KRNpIiMF6GJSUFpUq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4164	2988	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2988	532	rundll32.exe	81
PID 532 wrote to memory of 2988	532	rundll32.exe	81
PID 532 wrote to memory of 2988	532	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mmpack\App\imageformats\dll\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mmpack\App\imageformats\dll\libGLESv2.dll,#1
  2⤵
  PID:2988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 612
    3⤵
    - Program crash
    PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2988 -ip 2988
1⤵
PID:3032