46cfa385c4578edbd0f8220dabfdaafd513b29e4893882b6877200004fb62006

Analysis

max time kernel
91s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 16:32

Target

swiftshader/libGLESv2.dll
Size

2.7MB
MD5

d862f717702cd30757b93750f02dba79
SHA1

460dcbb4ac891cb06f99e470e98c119cfe77e634
SHA256

a2ec00a6ba14c3d2b937cbba0d06d5915292555a72453ca636ec9f5af1794a56
SHA512

cc2e95833ab6ab9ee84dd1fe15560ddaf32478eacbbec6f35d12514bd9afdf94a36e9b75621bee2217b56953fe9c02aa9c2a3f12a92fd47cf901149ced257a64
SSDEEP

49152:Gs3nfPLk4FeVIflUL2PYvl9ph1Re8eB3AxmTIqITgGE10/F7DyiVjgXADSOrdzn1:GcfPyOZFuY5FLfRZ17N

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2860 wrote to memory of 676	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 676	2860	rundll32.exe	rundll32.exe
PID 2860 wrote to memory of 676	2860	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
2⤵
PID:676