b693819185ea1a8f6b3cc03297eaf188553f7aaa455644c8341271fb104e4301

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 03:47

Target
swiftshader/libGLESv2.dll
Size 2.7MB
Sample240511-ecm2daed35
SHA256 bb4b5f0d578941c7fe912efd7da7453db85f88ec39081b03578aaf94c15beb12
MD5 4e9edcc1215783019a7af17eaed2b3f1
SHA1 3246e073fcb706a35882b5beafc8f93cff3f9b65
SHA512 3e2a035e50bf4202a57ea1b6307e089b7addee53041d41ffb374a1dde9c49bb888ec358030b19a2c3a0fa132daaf6553eb8d1576e68a9ea0231584454fc4931f
SSDEEP 49152:gSCBLsGp/5RsK+57hxxy9d7JJYxU3tWLbJp0rQT9daYI9mUuXgxL9PS1b5TWnDeB:nWLsGp//0pce9TWDe87F+pmRsZDt/gxs
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 2076	960	rundll32.exe	84
PID 960 wrote to memory of 2076	960	rundll32.exe	84
PID 960 wrote to memory of 2076	960	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
  2⤵
  PID:2076