e44fd281ff4ac842d66917e5f7bf43d7cf6b94afce95df2c8ee238e61cfbd0cd | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 22:17

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.2MB
MD5

438d089addd02af6f33b42f92cf19489
SHA1

b0de553d91c92e4d104d99a265442fbc51be67de
SHA256

05236819cd357b0f16ed2d8559a3c4da3b153ad7932ec2fd1d8e36d008a8633a
SHA512

0b6774d50becb18f471cbfb86aaa63cd360bb60f6fd77ab93b60c79f5019edcda6ccb23b6a7724f66b6ecedfefc0f0e2d098daee825185a261821903a3bc4fcb
SSDEEP

98304:tB7j4/0BuPMTUDUaG2u/hHZr7f7gsOMOe:b48KPBGzZr7fcsP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1824 -s 88
  2⤵
  PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads