55dd41e0614ba9b4406c926cc1fd970351d14d11552f3a85d522af46b0a49e46

Analysis

max time kernel
145s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 18:33

Target

SynapseX revamaped V1.2/bin/libEGL.dll
Size

306KB
MD5

a6bff6c3e64d7e0b93361c7696783e96
SHA1

b86339ad28e87c523b6c8bf9ff8787d5d390bd51
SHA256

f808b62775fd4a422e4fcff733ef185e7846e76c533e464cfeaddc96a25a8887
SHA512

c271243438ba54f27d6bd02d38ba4620199fda0ba9b373bfb7522fd128fc32e4028ff9ef9e02668f78c0f86446af3b3a4f8fcc2263e53301553f9a140816e65f
SSDEEP

6144:wfGwxWv6tN2phvpaKHBvb5ZzaYudGGWMfe/tpEEfh8odAcHH6cG:w+wxWyn2pFvb5ZzIsGWMfe/TtSodVn6c

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2652 wrote to memory of 392	2652	rundll32.exe	rundll32.exe
PID 2652 wrote to memory of 392	2652	rundll32.exe	rundll32.exe
PID 2652 wrote to memory of 392	2652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SynapseX revamaped V1.2\bin\libEGL.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\SynapseX revamaped V1.2\bin\libEGL.dll",#1
2⤵
PID:392