7526d982e57b6147b1a57a9bf4f65ef8558951484e123dfabc9260b164f10f7f

Analysis

max time kernel
265s
max time network
277s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
26-06-2024 06:02

Target

Additional/libGLESV2.dll
Size

1.5MB
MD5

aebbd25609c3f1d16809c02f12e99896
SHA1

7675d0f61062490b8c7043a66a8d88d5d147f7a9
SHA256

6765d163fae52331dfdcccab371c9b8b5cd0915bfdb14bbf2ca5d3f42bb29f4c
SHA512

a441ae0fe98ae39ed7fd1feb410bcac3aba9179242c62166190926588b97e11f0a3442d0619c6a2f6070e336a82d7fcabeb89461ff15fe878da13f2a57710f87
SSDEEP

24576:IGyEmXb3NBT+BZDQnVjDuBy8aTnilzT8QreNdJU8GAeZRyRWh:I8mr3OaDVXnilcQreNdJU8GOWh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3692 wrote to memory of 480	3692	rundll32.exe	rundll32.exe
PID 3692 wrote to memory of 480	3692	rundll32.exe	rundll32.exe
PID 3692 wrote to memory of 480	3692	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Additional\libGLESV2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Additional\libGLESV2.dll,#1
2⤵
PID:480