b693819185ea1a8f6b3cc03297eaf188553f7aaa455644c8341271fb104e4301

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 03:47

Target

swiftshader/libGLESv2.dll
Size

2.7MB
MD5

4e9edcc1215783019a7af17eaed2b3f1
SHA1

3246e073fcb706a35882b5beafc8f93cff3f9b65
SHA256

bb4b5f0d578941c7fe912efd7da7453db85f88ec39081b03578aaf94c15beb12
SHA512

3e2a035e50bf4202a57ea1b6307e089b7addee53041d41ffb374a1dde9c49bb888ec358030b19a2c3a0fa132daaf6553eb8d1576e68a9ea0231584454fc4931f
SSDEEP

49152:gSCBLsGp/5RsK+57hxxy9d7JJYxU3tWLbJp0rQT9daYI9mUuXgxL9PS1b5TWnDeB:nWLsGp//0pce9TWDe87F+pmRsZDt/gxs

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 960 wrote to memory of 2076	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 2076	960	rundll32.exe	rundll32.exe
PID 960 wrote to memory of 2076	960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
2⤵
PID:2076