dfca2f1a842aea69a2b0a22ca66fa7852f86259e3da4f576f8ae7fa16f1e9134 | Triage

Analysis

max time kernel
114s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
08-07-2024 09:22

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

6.5MB
MD5

d7b0d5753bac1c455d119410270ecf43
SHA1

b7e90b3e355f701afbdf733468720b469f3f2a50
SHA256

a6a1967b8c258bf0738bb3b14c0c5a4320550ea21486003f6229b4c3ec007502
SHA512

e21576032eda439cbda6724bcf882fd402ea4f2812e3bb31833724ed5c98017ca36c4f908e5d9b4b406ddb9bf52c4d24a8901f776d76a688892a6303af0cf610
SSDEEP

98304:8PDtq74MUWFx1XH0JXCrhXIBCfb9D4qJZ1O5Z8akVOJjvB8z:YD/Kx1WKWBkF4z5cQJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4716 1136 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1992 wrote to memory of 1136	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1136	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1136	1992	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
2⤵
PID:1136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 460
3⤵
- Program crash
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1136 -ip 1136
1⤵
PID:5032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads