66745a4257b713585ce8e7b16edd8ae00d247f713ad6ea02dc4c39ef94b8c677

Resubmissions

28-05-2024 10:29

max time kernel
132s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 10:29

Target

swiftshader/libGLESv2.dll
Size

2.7MB
MD5

509c301d29ab71a65ee862530c0fdd65
SHA1

26a4c13749b6833635ba3280d319bdedc17f5fcc
SHA256

352448e802fb4947bdf8225844036de01200acbc4d85ae9b9d1eb95a769560af
SHA512

6150289efa7e2939d3f08d568ab2fa540e40fc640acb8919ae215b596905e88a0ee763f126c6de1e39fb5bfa676aa7d7f614020137288cced7d10c727011f4f3
SSDEEP

49152:4dnrjtIvoFzKkAdACGPIuV95gE+pZRNA32yJ6uhH2elKnmeEkAz4RnEoJ2rdzNBJ:4F3tfKNtja1MZdZ1X

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1932 wrote to memory of 4356	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 4356	1932	rundll32.exe	rundll32.exe
PID 1932 wrote to memory of 4356	1932	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
2⤵
PID:4356