cfcd10600d1606d39f345271772578aca4c5c489aebfc4cc870aed1036437234

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 17:16

Target
data/data/lwjgl_opengl.dll
Size 333KB
Sample241119-vtedkayeje
SHA256 92aec0f2b142a56ad8f361919ee0e6b387c92269efc9645071db6561ae9b6324
MD5 780ed18868c28c0c249379982ea3297a
SHA1 8e9836dd0d1691356db654aa02533ad80e9bf52c
SHA512 430136fa22df4753c460ba4f3bfe18f9be1b1d0f0b59deedb9d5ba1e1db54ae5da3a74c3951eb59ae0b8760b5b6806373a76811c5b6f69f18bd966978f5d0e1f
SSDEEP 3072:4LVyef0be4PP+OI7RSW3Dm/W99vMdvBAoF/5OZX2lh2mH3+F5Tye:MVrQnXrW3iWCaZeO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2268	2472	rundll32.exe	31
PID 2472 wrote to memory of 2268	2472	rundll32.exe	31
PID 2472 wrote to memory of 2268	2472	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\data\lwjgl_opengl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2472 -s 80
  2⤵
  PID:2268