aaf20e1523773d6a7f05297cb48c01b63ce2538ea47403191ff6cdc9f364b148

Analysis

max time kernel
1482s
max time network
1511s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
13-05-2024 17:36

Target

Synapse-X-Revamped-main/libEGL.dll
Size

306KB
MD5

a6bff6c3e64d7e0b93361c7696783e96
SHA1

b86339ad28e87c523b6c8bf9ff8787d5d390bd51
SHA256

f808b62775fd4a422e4fcff733ef185e7846e76c533e464cfeaddc96a25a8887
SHA512

c271243438ba54f27d6bd02d38ba4620199fda0ba9b373bfb7522fd128fc32e4028ff9ef9e02668f78c0f86446af3b3a4f8fcc2263e53301553f9a140816e65f
SSDEEP

6144:wfGwxWv6tN2phvpaKHBvb5ZzaYudGGWMfe/tpEEfh8odAcHH6cG:w+wxWyn2pFvb5ZzIsGWMfe/TtSodVn6c

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5096 wrote to memory of 3388	5096	rundll32.exe	rundll32.exe
PID 5096 wrote to memory of 3388	5096	rundll32.exe	rundll32.exe
PID 5096 wrote to memory of 3388	5096	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Synapse-X-Revamped-main\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5096

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Synapse-X-Revamped-main\libEGL.dll,#1
2⤵
PID:3388