809f6517480548b9976840145ff402d2598cdf6cc7bc210646306957ca41032e

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-09-2024 14:12

Target

libGLESv2.dll
Size

7.5MB
MD5

acb87fb8d7c650f7f731fec86547818d
SHA1

1dac2a461585c4f13930707eca8bc20ba77e3630
SHA256

eb647d5bd0593487451804f4aae20a3f5dfcb004c42d3039d15b723c1be592c4
SHA512

e3cbf91d8334868f077535e5c0ceff512fad9b91785fed157383a15bcfa3375bad4df9e72b9b9ade1ae337e12fe18f2b03d26adabe4ef569ea0dc51772f9a044
SSDEEP

49152:zYpFY0GcBM7Nnuc7xVnz27zg+Bim/7ZIoa8t8SawwZN+eUBop6epY/23LdIdyJ4M:mrGvnz27xIo6qN9hQwf71L6aKJ4liD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2988	3012	rundll32.exe	30
PID 3012 wrote to memory of 2988	3012	rundll32.exe	30
PID 3012 wrote to memory of 2988	3012	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3012 -s 88
  2⤵
  PID:2988