68eeefd2b6980e569d198701c952a8bc7b7643809fa9c6216d2285a34d119719

Analysis

max time kernel
449s
max time network
458s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
23-05-2024 06:06

Target

swiftshader/libGLESv2.dll
Size

2.9MB
MD5

7f748878bf48f3595d37877092d77612
SHA1

b7eefb46fcac9ac6da0d611b6c1773f6d94883f0
SHA256

34f7ae8e30ec3dfc67927341b3cb0a88b226b6ac6c6f006a43d828e6d8248c9d
SHA512

8149bbc21b9d0b4540028f0fd88310e9cf35c29e8a1e0c4ea4ed5a062732f489090760464c297d95f2ce4b8212e98f3ad9d0744078b1b2abe4a52d3b174ccfa5
SSDEEP

49152:WVXVY1923C/oQKE6YGu6BKi1dpx8+xDGjKwH8TiHWA/Zbl2BOPVrOcyevibtQw3C:WVF823CQQKKw3uCbDo9OvnzBzu3QL5+/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4788 wrote to memory of 4936	4788	rundll32.exe	rundll32.exe
PID 4788 wrote to memory of 4936	4788	rundll32.exe	rundll32.exe
PID 4788 wrote to memory of 4936	4788	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4788

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
2⤵
PID:4936