0049ff8214d96fe8a7f5dd40934dad318226ef6b7222aea2a730b7983734816a | Triage

Analysis

max time kernel
3s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 06:19

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.3MB
MD5

c783045e4b7f00c847678d43a77367f7
SHA1

7f9192ce0b23ac93561aeec9d9c38daa3136c146
SHA256

3a39137dcee6cb6663ae9cca424b6b05cf56c0ad7e32fb72cb94549ea9dbcae8
SHA512

64e6d4fc84f1217ceef05a22ad63a6618ffdc470b1faf4ad9e2d7bab59e9285527b9c5fd7ea4be673a08b9466434e3c098e839bf6955597e3d8aa0e80589f4a3
SSDEEP

98304:A99bSJY8juRSvODN1uVZ5U7NJhbXm3fP:Aeu8iEOx73hzCfP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2956 wrote to memory of 2308	2956	rundll32.exe	WerFault.exe
PID 2956 wrote to memory of 2308	2956	rundll32.exe	WerFault.exe
PID 2956 wrote to memory of 2308	2956	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2956 -s 92
  2⤵
  PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads