68eeefd2b6980e569d198701c952a8bc7b7643809fa9c6216d2285a34d119719

Analysis

max time kernel
451s
max time network
455s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
23-05-2024 06:06

Target

swiftshader/libEGL.dll
Size

325KB
MD5

12ea215487d10e6855cd9cc171f8c297
SHA1

e4d1e88e684ef25938df4eb4f2b23411e74892bf
SHA256

1ee05c4c7549f8384eaa6306a5a6efc22faf683354e8240eaec8c17d8f980280
SHA512

6d219a453b110e5505a1c01765b3eb3f140e8ce8f24006626679fc1e9be226e7a49b3d620c114292a28d11722a9b7acb24c6765242f729331f113461934b2806
SSDEEP

6144:MH8fxwzcDrVQRN+9s7kbi1bDJ6Kv/PLj+ZHcq5RdZKtmpLul4+:o8fxwAXVQRQ9s7kvKjj+ZHcYTimpLul4

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1640 wrote to memory of 4068	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 4068	1640	rundll32.exe	rundll32.exe
PID 1640 wrote to memory of 4068	1640	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
2⤵
PID:4068