a4f7b21dc88bdcf27cbe929d4bba979f759320b53f7e826bc0a77f55ebbf866c

Analysis

max time kernel
145s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 01:07

Target
!ŞetUp_51286--#PaSꞨKḙy#$$/Libs/libEGL.dll
Size 258KB
Sample240706-bgs7ea1dmn
SHA256 a96cdb651c862120489b30b40a716c3f20b772ac4ba8fc70aaccbb1a568005f2
MD5 3abaa006e1842b5a3cbed2a41476cae8
SHA1 717f3cf9e7c07073f41841cd7fa9858b76265b33
SHA512 84fa2bf370797c7ad2e63287b6e4bb785a88871830ad261ae38afb05cf8bac574f68539bdc0327c3c254a49e52c7da28bc0ee748db99b2f82ca86b08d9f18735
SSDEEP 6144:O1w9H8OGFO/vqX/PSOW8ijs9z6Y1gpAOs+4uL68:O1aUFO/vqX/Pz2sb1gpjzv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	4928	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4928	4752	rundll32.exe	83
PID 4752 wrote to memory of 4928	4752	rundll32.exe	83
PID 4752 wrote to memory of 4928	4752	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\!ŞetUp_51286--#PaSꞨKḙy#$$\Libs\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\!ŞetUp_51286--#PaSꞨKḙy#$$\Libs\libEGL.dll,#1
  2⤵
  PID:4928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 604
    3⤵
    - Program crash
    PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4928 -ip 4928
1⤵
PID:3452