7fa3c53115c61a095da7ce93276e828198fba45f93c30bf245a0ffd9266a77bf | Triage

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-11-2024 13:52

Sharing

Report Analysis Logs

General

Target

app-11.17.0/libGLESv2.dll
Size

7.5MB
MD5

69247a913e1415d30e9bab29e8af3b07
SHA1

93c18079a14103577cb60988cf9685b3ffdee824
SHA256

1a818a7399a797d0b1d59df87176840916fbcaf74303f0eefb4f58436a10c8f0
SHA512

6e89fa9a2ee6781e948007193c32b6f76aa7911a546ab28b3e4aca5a5ecf9d8f34b20c3e0c76b29c05c890ba506448db25544eeede25e9a001c931d1cd0917ce
SSDEEP

98304:4fokq3nHFGE9l83JKJ5pPIg3jMgekXm3eSIwLK:ZYAK5KLpj3/egCeSIOK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1796 wrote to memory of 1940	1796	rundll32.exe	WerFault.exe
PID 1796 wrote to memory of 1940	1796	rundll32.exe	WerFault.exe
PID 1796 wrote to memory of 1940	1796	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\app-11.17.0\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1796 -s 88
  2⤵
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads