77c6385d064b1053db2f29e83e6ea83a2c33098b34ae6c4508bf969a97ed7008

Analysis

max time kernel
141s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 03:50

Target

swiftshader/libGLESv2.dll
Size

2.7MB
MD5

6a5704a246535ee666b1cf87e10eb53c
SHA1

c9d74edd160314b780a76b5ebfda3c0cfe2e5606
SHA256

f3ed98d9c3e915b6c55bcb9a17e162134ce9897c5246110bc2955cac5851fe2a
SHA512

e8b2a39bb50a6117738fc593cdb07f8b4a87bc6465fd61de82cd33156ebdf5d714d389b2e74f0d284801e0ac09704a21b46a005ded8ab8ad9b9291bbbb5a43be
SSDEEP

49152:rvRd9FO9MwdFA/w1s+Glqa/KxB2CgfFK1GokWFBB4PD6xABXGfSqnVjxSEhnR3qq:jRd/CcMxgUrXr1j12eJQo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4528 wrote to memory of 3164	4528	rundll32.exe	rundll32.exe
PID 4528 wrote to memory of 3164	4528	rundll32.exe	rundll32.exe
PID 4528 wrote to memory of 3164	4528	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
2⤵
PID:3164