30091faafd62ea7ba9868db2ee575dab98fd126a78d39590f57ea7b38b20d966 | Triage

Resubmissions

02-12-2024 01:25

241202-bszhkaxlfj 7

21-09-2024 21:03

240921-zwgnxstdke 10

21-09-2024 20:29

240921-y9lz5asajd 10

Analysis

max time kernel
1561s
max time network
1566s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 01:25

Sharing

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.3MB
MD5

c783045e4b7f00c847678d43a77367f7
SHA1

7f9192ce0b23ac93561aeec9d9c38daa3136c146
SHA256

3a39137dcee6cb6663ae9cca424b6b05cf56c0ad7e32fb72cb94549ea9dbcae8
SHA512

64e6d4fc84f1217ceef05a22ad63a6618ffdc470b1faf4ad9e2d7bab59e9285527b9c5fd7ea4be673a08b9466434e3c098e839bf6955597e3d8aa0e80589f4a3
SSDEEP

98304:A99bSJY8juRSvODN1uVZ5U7NJhbXm3fP:Aeu8iEOx73hzCfP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 2284	1880	rundll32.exe	31
PID 1880 wrote to memory of 2284	1880	rundll32.exe	31
PID 1880 wrote to memory of 2284	1880	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1880 -s 88
  2⤵
  PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads