77c6385d064b1053db2f29e83e6ea83a2c33098b34ae6c4508bf969a97ed7008

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 03:50

Target

swiftshader/libEGL.dll
Size

379KB
MD5

2b35e2670411b0e46569c702723bf455
SHA1

23059a9001e1bc5d4ecd2a2995a80bce01dfc217
SHA256

74f934004b27fa48154876bba8710e301c75aa3d9125e6180c4486b139159801
SHA512

822821a14f48d85a6c265530fa93c46fc781149e050576f031a6f27d0288f24f7f9b341fd7fe9179b1b32627f91b7db44301aefb73e51dfdf778b10a9d1242f7
SSDEEP

6144:cayLoJ01tUL3Q3LjSPu5FUuJiHMPyfV2Wf5gqIhCTQVBGXaZDseVMgfu1aNwqNxP:f01tSInGV26iPCTQVCaLfu1aNwGp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4504 wrote to memory of 5108	4504	rundll32.exe	rundll32.exe
PID 4504 wrote to memory of 5108	4504	rundll32.exe	rundll32.exe
PID 4504 wrote to memory of 5108	4504	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
  2⤵
  PID:5108