c4a93d85f3bdd338ab1e531720fdd25295164709a5d907907a0736cce01abe3a

Analysis

max time kernel
136s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2023 11:26

Target

Version_Unlimited/bin/opengl32sw.dll
Size

14.5MB
MD5

3bd5aea364326cdfa667651a93e7a4c9
SHA1

f33b4a83e038363c1a4df919e6f6e0e41dba9334
SHA256

23f04ba936568e9a7c9dce7a6beb52c9be7eb13b734cd390c99e7546cbe1973d
SHA512

7bd4e742b4d683b79de54eaf7d8b215252212921b8a53d1fbfc8e51ce43505c003da62fd126663bc04bbc65b8f77b85232c78ea6ecba8a4e425c28c0e9c80dc3
SSDEEP

393216:00Rly5ZnSHLe1tvwDTtwJuefdrX780dNYbg4A358TjGNrS1aKbBICZBSJLGWIGC2:NRlyP71tvwDTtwJuefdrX780dNYbg4Az

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1804 rundll32.exe
1804 rundll32.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3828 wrote to memory of 1804	3828	rundll32.exe	rundll32.exe
PID 3828 wrote to memory of 1804	3828	rundll32.exe	rundll32.exe
PID 3828 wrote to memory of 1804	3828	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Version_Unlimited\bin\opengl32sw.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Version_Unlimited\bin\opengl32sw.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1804