809afb2bb8fa462096e9c968a357f5f2c06cda43e235d375d8219fa5c4421ca9 | Triage

Analysis

max time kernel
140s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 10:45

Sharing

Report Analysis Logs

General

Target

angle/libEGLMarmalade.dll
Size

143KB
MD5

f42a57c56503b86df8893bb4f47cdf4b
SHA1

edf9c393c8af8f056f6b728713a45e5369995cb3
SHA256

0085fe9764dcf17af18b9bf83875964e94a0749d9f7f65389d8d381335568d0a
SHA512

0116c38bc231c9654172855ba9aab77adbd941ee4e193ec2aaaad6c7fa662a372d5d7bbceda62bd877aa91212f83ef5dff2e8fec6830626dd0f9b58ce47eb911
SSDEEP

3072:Sx4vPpGQ+dnWcEsFWDyQf+xy6+GLqeb52t9X:E4npiKssDVf+4ZGLT4td

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 5060	5076	rundll32.exe	83
PID 5076 wrote to memory of 5060	5076	rundll32.exe	83
PID 5076 wrote to memory of 5060	5076	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\angle\libEGLMarmalade.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\angle\libEGLMarmalade.dll,#1
  2⤵
  PID:5060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5060-0-0x0000000000B90000-0x0000000000C6D000-memory.dmp

Filesize
884KB

Download