30091faafd62ea7ba9868db2ee575dab98fd126a78d39590f57ea7b38b20d966 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 20:00

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.3MB
MD5

c783045e4b7f00c847678d43a77367f7
SHA1

7f9192ce0b23ac93561aeec9d9c38daa3136c146
SHA256

3a39137dcee6cb6663ae9cca424b6b05cf56c0ad7e32fb72cb94549ea9dbcae8
SHA512

64e6d4fc84f1217ceef05a22ad63a6618ffdc470b1faf4ad9e2d7bab59e9285527b9c5fd7ea4be673a08b9466434e3c098e839bf6955597e3d8aa0e80589f4a3
SSDEEP

98304:A99bSJY8juRSvODN1uVZ5U7NJhbXm3fP:Aeu8iEOx73hzCfP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 780 wrote to memory of 2444	780	rundll32.exe	31
PID 780 wrote to memory of 2444	780	rundll32.exe	31
PID 780 wrote to memory of 2444	780	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 780 -s 88
  2⤵
  PID:2444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads