479f024e77b53300da8dd0e0d0243dca32af5c1aefaa2f254127bc59f2901d93

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 11:24

Target

libGLESv2.dll
Size

7.2MB
MD5

60e42e83b260582fc96aaf43293d99e1
SHA1

c548a10873f9a57e18c7fbb1fe89685f4cf1ba84
SHA256

25d49934fc220b169cadeb21fc99dc2a8fb1dd5a4f244265799392f0f5f2f8f8
SHA512

6a905e2b9427fb6e4a53080afdc2ae9dc32c54aab5460f88f7d3fd16e7e9a841d332057f58942d54defe91361a54d3cbedba295399cead754f353f80f92f238b
SSDEEP

49152:Rs95E5fqF3q/xEpLJgw7yQj1+lSWsucneTA4fwEmN428bbvbgNqay6q/iyGtxJe5:2lq3ZieHhogDbBztUecv7r7frgsOMG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2924 wrote to memory of 2832	2924	rundll32.exe	WerFault.exe
PID 2924 wrote to memory of 2832	2924	rundll32.exe	WerFault.exe
PID 2924 wrote to memory of 2832	2924	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2924 -s 88
2⤵
PID:2832