965faa9d136d712e2a5008849ebee26b11a375a8d6b1e7fce72c9b730afba375 | Triage

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 13:30

Sharing

Report Analysis Logs

General

Target

libGLE.exe
Size

12.8MB
MD5

abe7c67099af71c51e5ab3219afb5908
SHA1

d521769e0f6b8eb7907a1b2f497ec70c68c08cf0
SHA256

c2695d7cfa0854af40e36276df25cb46aad09f035a02a273cd2e8270e221c9dc
SHA512

e5e7557b5c6470d3f9e24bd5994585a49562f719b5a682816d1988f69664fce8339d902ea9a19ccfa72f99851fb2a7739b9f559690a1b8747d8121145eb141ec
SSDEEP

393216:UNWdqshZ2YsHFUK2JadQJlewF3MnG3xl5nTBqrIWdRaDH:28pZ2YwUlJadQT3MGxVF2q

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2748	libGLE.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2748	2308	libGLE.exe	31
PID 2308 wrote to memory of 2748	2308	libGLE.exe	31
PID 2308 wrote to memory of 2748	2308	libGLE.exe	31

C:\Users\Admin\AppData\Local\Temp\libGLE.exe
"C:\Users\Admin\AppData\Local\Temp\libGLE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\libGLE.exe
  "C:\Users\Admin\AppData\Local\Temp\libGLE.exe"
  2⤵
  - Loads dropped DLL
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI23082\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit