c954ba4d9f8e230d8fd42b5fa0bd25bd978725b78b9473e23da4740cda0606c1

Analysis

max time kernel
50s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:59

Target

swiftshader/libEGL.dll
Size

379KB
MD5

2b35e2670411b0e46569c702723bf455
SHA1

23059a9001e1bc5d4ecd2a2995a80bce01dfc217
SHA256

74f934004b27fa48154876bba8710e301c75aa3d9125e6180c4486b139159801
SHA512

822821a14f48d85a6c265530fa93c46fc781149e050576f031a6f27d0288f24f7f9b341fd7fe9179b1b32627f91b7db44301aefb73e51dfdf778b10a9d1242f7
SSDEEP

6144:cayLoJ01tUL3Q3LjSPu5FUuJiHMPyfV2Wf5gqIhCTQVBGXaZDseVMgfu1aNwqNxP:f01tSInGV26iPCTQVCaLfu1aNwGp

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 1656	700	rundll32.exe	83
PID 700 wrote to memory of 1656	700	rundll32.exe	83
PID 700 wrote to memory of 1656	700	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
  2⤵
  PID:1656