39cdff6c5715ddf50fd2be798f948bf6a90e743a20c1d5fc0648269376af444b

Analysis

max time kernel
131s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 01:14

Target
libEGL.dll
Size 358KB
Sample240110-blz6hsccc6
SHA256 c3c1b3acfe150d91210bb914d9c45d1eae3aea85a4701e4b956f7570fe6c7eac
MD5 4de8b75062e3615e2ed9f6f355a7f1fb
SHA1 395da0c5d5c8aa2493d733c4326c22f4c2e5b79a
SHA512 fff54ce4aa86b25489c53455b5157025a201476f415605a6c3c2324253c9b3e55a3f31434551509d9d271af53103fa1755bdfd04c211362e0631455a3dfef4e7
SSDEEP 6144:E9+a9/zhtHT4/7n6JRERpY5W5SaFqThIp4YkZHrDaIcIGxVJ:E9+krhg70oYmFqTzNrDaIEVJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 1676	1416	rundll32.exe	11
PID 1416 wrote to memory of 1676	1416	rundll32.exe	11
PID 1416 wrote to memory of 1676	1416	rundll32.exe	11

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libEGL.dll,#1
  2⤵
  PID:1676