cfcd10600d1606d39f345271772578aca4c5c489aebfc4cc870aed1036437234 | Triage

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 17:16

Sharing

Report Analysis Logs

General

Target

data/data/lwjgl_opengl.dll
Size

333KB
MD5

780ed18868c28c0c249379982ea3297a
SHA1

8e9836dd0d1691356db654aa02533ad80e9bf52c
SHA256

92aec0f2b142a56ad8f361919ee0e6b387c92269efc9645071db6561ae9b6324
SHA512

430136fa22df4753c460ba4f3bfe18f9be1b1d0f0b59deedb9d5ba1e1db54ae5da3a74c3951eb59ae0b8760b5b6806373a76811c5b6f69f18bd966978f5d0e1f
SSDEEP

3072:4LVyef0be4PP+OI7RSW3Dm/W99vMdvBAoF/5OZX2lh2mH3+F5Tye:MVrQnXrW3iWCaZeO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2268	2472	rundll32.exe	31
PID 2472 wrote to memory of 2268	2472	rundll32.exe	31
PID 2472 wrote to memory of 2268	2472	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\data\data\lwjgl_opengl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2472 -s 80
  2⤵
  PID:2268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads