5552455c5f953e0d18d1eb8a7b3bde5d0d2c795510699e11f863747f9964313c

Analysis

max time kernel
447s
max time network
1174s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 20:24

Target

swiftshader/libEGL.dll
Size

380KB
MD5

787aaeb01aa0774ca8276224448dae6f
SHA1

40ec1e7c87efb0c19dc5dec1b4a0f230e071b85d
SHA256

460124a6280f377899ab94eb6d5482cd024a1557cc8b804aa4f95dc881501e47
SHA512

51a4c8fe33bce314aaa10738b1941fa7d349f5b1ea092982baea94dc2a7e6eaeaa35751c15eabb50424c25e1fbc0d8560138a674eaa19a3134522fdd808caf52
SSDEEP

6144:jnnDGfjICPhRPvvFT0I0Ygsni1ImmcHebjuVKIq2qcsW8xm8H4ZdbClbK7x3QeOo:jUvFZ0YgJEjuVKIq2dbubOOo

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 2268	3592	rundll32.exe	81
PID 3592 wrote to memory of 2268	3592	rundll32.exe	81
PID 3592 wrote to memory of 2268	3592	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
  2⤵
  PID:2268