b693819185ea1a8f6b3cc03297eaf188553f7aaa455644c8341271fb104e4301

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 03:47

Target
swiftshader/libEGL.dll
Size 372KB
Sample240511-ecm2daed35
SHA256 af3357c7a13ee6e89d128f4ae1f45759d15a60ce01fde21a4165921ad74d842a
MD5 f8ee4e4798c773c5bfc6efca54cb2a79
SHA1 32e78735272210883267940ad694f43b15b69143
SHA512 cb1bcb82a2c344f7d9d49f7b6ffed2776a1667e7d71cc4e92d8952b560eb7c03daa68305d16bb09741cc2ad0023a34f0d09d51dc30864567a61b5e30122221ac
SSDEEP 6144:V+jv9NINABpRcpflx3sSOYlYg64Q8goGa84V/vuqRIizwgjnFghINUB4Qu1KJTSe:AmABpRcpflNJOOB64QEGev3IizwgxVQD
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2872	1644	rundll32.exe	84
PID 1644 wrote to memory of 2872	1644	rundll32.exe	84
PID 1644 wrote to memory of 2872	1644	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
  2⤵
  PID:2872