372b81cb23efd1c29173c72b812793d0e2b60cd4befd8c6917a206830a4c5af3 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 14:52

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.6MB
MD5

dd8d815769cbf46af41a41931e9b4572
SHA1

f242fcc4cfd5030f3f543c22f141185cd86e7142
SHA256

dd74029716da56a0e4b64bc5cea0c169e1c4b31143ff39213d3c544792e8f2b9
SHA512

69a12f862157746ffc27b637941261a0c5c494175c3e674c7de4d0c4452a5b9358735944e8e0568b7279a7791cf178c9b1afd5ea4a781e93f28cd775a0a6096f
SSDEEP

98304:p5a6GJCIf2Knqdu5iIBIcbWwYSqARSHoDNSv:pKIwBqARSH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 3060	2848	rundll32.exe	30
PID 2848 wrote to memory of 3060	2848	rundll32.exe	30
PID 2848 wrote to memory of 3060	2848	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2848 -s 88
  2⤵
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads