ac94101c9d78aded5c0ce3207fb99bb4cb7083ec635b6fe7ed26b9414930d7ae

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 21:58

Target

swiftshader/libGLESv2.dll
Size

2.7MB
MD5

1a22c4d3ec328df224efecae7174fe28
SHA1

13d8495036d0c9f1626ec6b218d8e59a8964d960
SHA256

a09ff693d7e47cdb8b3cf33b7497d78a33a69b71f41fbff48c6498f13aad7e67
SHA512

18e918914f7e706300021ad6844103825a68c698f19c179e34d9490f1717a5482813e451e435d63bf0afb36f2b52fb051ca8ca48acbc76acdb4ef469446d8596
SSDEEP

49152:DdnrjtIvoFzKkAdACGPIuV95gE+pZRNA32yJ6uhH2elKnmeEkAz4RnEoJ2rdzNBo:DF3tfKNtja1MZdZ1X

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 4420	3540	rundll32.exe	69
PID 3540 wrote to memory of 4420	3540	rundll32.exe	69
PID 3540 wrote to memory of 4420	3540	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
  2⤵
  PID:4420