dfca2f1a842aea69a2b0a22ca66fa7852f86259e3da4f576f8ae7fa16f1e9134 | Triage

Analysis

max time kernel
130s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
08-07-2024 09:22

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

349KB
MD5

8bebd9d7a89cff012ef4d6382532f0d3
SHA1

224070195e2cbfe684d6f505574c75004771d618
SHA256

dc2c4ab947a3f766f554e156157ab6522aaa430d3b40dc4612074debcd728833
SHA512

daf6dc7116d8ea38ff352fe92e217d6b327d2b75bee77a1bb998cb8655749d2670e91beb63821862ddffb94bf512a666effaf11fef7a2347b078436d01e66d79
SSDEEP

6144:LZ1ThqpvHDfn9c32bFyCzoT0WeqMuQ/EPSBLVm+NiY/tCj+bt:LZnqpvW32bFyzotuQ/YSM268

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 880 wrote to memory of 764	880	rundll32.exe	rundll32.exe
PID 880 wrote to memory of 764	880	rundll32.exe	rundll32.exe
PID 880 wrote to memory of 764	880	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
2⤵
PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads