30091faafd62ea7ba9868db2ee575dab98fd126a78d39590f57ea7b38b20d966 | Triage

Resubmissions

22-09-2024 11:26

240922-njxntsxckr 10

22-09-2024 11:13

240922-nbfqcawgrm 10

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-09-2024 11:13

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.3MB
MD5

c783045e4b7f00c847678d43a77367f7
SHA1

7f9192ce0b23ac93561aeec9d9c38daa3136c146
SHA256

3a39137dcee6cb6663ae9cca424b6b05cf56c0ad7e32fb72cb94549ea9dbcae8
SHA512

64e6d4fc84f1217ceef05a22ad63a6618ffdc470b1faf4ad9e2d7bab59e9285527b9c5fd7ea4be673a08b9466434e3c098e839bf6955597e3d8aa0e80589f4a3
SSDEEP

98304:A99bSJY8juRSvODN1uVZ5U7NJhbXm3fP:Aeu8iEOx73hzCfP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 592	2028	rundll32.exe	30
PID 2028 wrote to memory of 592	2028	rundll32.exe	30
PID 2028 wrote to memory of 592	2028	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2028 -s 88
  2⤵
  PID:592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads