34e141c88f20dffe25bf118a427415ce55cbc123848a2f6d2d5ccfe390a746ec | Triage

Analysis

max time kernel
85s
max time network
203s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
23-07-2024 09:31

Sharing

Report Analysis Logs

General

Target

Wave/CrackedWave/libEGL.dll
Size

359KB
MD5

7dd6b0e4a31d35a0fae5ff425707073c
SHA1

fbd12e9f8e2252c52ce555c2ebbd7f07e62a0140
SHA256

8762d8001fc3ddd90e3129dfea172817e8d09b9936eaae391957de4326c8c906
SHA512

726968df6b83ab5f589276672250d92f532fe2dcea2176e42031a7f1dcecf578b0320cfe2a7d88bb9883ad99387d71c6ebf1e9968272bb5e62850ef09abd2648
SSDEEP

6144:74otxiotonwSbWTbrTEHdyVwiCSH/gWqkEC/D789uOSna:soL3VCWTbrTEHdyZp6I

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 3544	5004	rundll32.exe	78
PID 5004 wrote to memory of 3544	5004	rundll32.exe	78
PID 5004 wrote to memory of 3544	5004	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wave\CrackedWave\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wave\CrackedWave\libEGL.dll,#1
  2⤵
  PID:3544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads