7635079472f751071c32a41949affd5f1e70a9f01c173f8e1ba0ae41302ea97e

Analysis

max time kernel
3s
max time network
69s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 08:09

Target

RJ01082861-PC/swiftshader/libEGL.dll
Size

99KB
MD5

adc1b8ed43379d0174c143bfcc0333dc
SHA1

2131bd3a50b34f0e9857048582262eabd4f8f21f
SHA256

2e0f536a85e3986b3ce5251fb9901f7e09f7d133318c43bccc24a11a9eeb2c49
SHA512

742a696d0038d7fcd0fc0c7f107088e00be16e4816090e1643698eec320ed9b2a5167526eec70d9418004b3fc953269e1c75639621a8c5f5dfdbee876a35fda0
SSDEEP

1536:1KJYBYySjEdmDgUFpO+KxyWBeowPsuTsWjvVcdQ/rkZlBj6BY:1KmayS+UlFRKnuj2Q4ZlBj6B

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 884	2472	rundll32.exe	30
PID 2472 wrote to memory of 884	2472	rundll32.exe	30
PID 2472 wrote to memory of 884	2472	rundll32.exe	30
PID 2472 wrote to memory of 884	2472	rundll32.exe	30
PID 2472 wrote to memory of 884	2472	rundll32.exe	30
PID 2472 wrote to memory of 884	2472	rundll32.exe	30
PID 2472 wrote to memory of 884	2472	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\swiftshader\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\swiftshader\libEGL.dll,#1
  2⤵
  PID:884