fc57397a75803becfc4bbef7ed49fa476a97f9be46014e2617602d27fcf5b3e8 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 20:23

Sharing

Report Analysis Logs

General

Target

libEGL.dll
Size

400KB
MD5

11e3271940091632a2c58216b0e9849b
SHA1

c969c96e7a95498dc4a7cf349d3498f6ab9bb665
SHA256

b32761ab539a94c123c51daf3b6fb86794f7b73ddb313c978eb0917741d2a939
SHA512

1d0107c86e7352619f75c20a314bcf950c9a0cbd5dfd3ecd7fa1c3879b791edb2a64818dcd640b2cce1a2b5e99ad576bffea89dfceede785a6de6c15c222d6ed
SSDEEP

6144:cAVXpNgQ3V3y+lBRrb3RuN8Nkp6mpbScfF+BHKTFcvLUP:ceUQF3y+lBR/BuDZGc6wyUP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1368 wrote to memory of 2056	1368	rundll32.exe	WerFault.exe
PID 1368 wrote to memory of 2056	1368	rundll32.exe	WerFault.exe
PID 1368 wrote to memory of 2056	1368	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1368 -s 84
2⤵
PID:2056

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...