77c6385d064b1053db2f29e83e6ea83a2c33098b34ae6c4508bf969a97ed7008

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 03:50

Target
swiftshader/libEGL.dll
Size 379KB
Sample240519-eeb2wshb98
SHA256 74f934004b27fa48154876bba8710e301c75aa3d9125e6180c4486b139159801
MD5 2b35e2670411b0e46569c702723bf455
SHA1 23059a9001e1bc5d4ecd2a2995a80bce01dfc217
SHA512 822821a14f48d85a6c265530fa93c46fc781149e050576f031a6f27d0288f24f7f9b341fd7fe9179b1b32627f91b7db44301aefb73e51dfdf778b10a9d1242f7
SSDEEP 6144:cayLoJ01tUL3Q3LjSPu5FUuJiHMPyfV2Wf5gqIhCTQVBGXaZDseVMgfu1aNwqNxP:f01tSInGV26iPCTQVCaLfu1aNwGp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 5108	4504	rundll32.exe	86
PID 4504 wrote to memory of 5108	4504	rundll32.exe	86
PID 4504 wrote to memory of 5108	4504	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
  2⤵
  PID:5108