c954ba4d9f8e230d8fd42b5fa0bd25bd978725b78b9473e23da4740cda0606c1

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 02:59

Target
swiftshader/libGLESv2.dll
Size 2.7MB
Sample240613-dg5asasbpc
SHA256 f3ed98d9c3e915b6c55bcb9a17e162134ce9897c5246110bc2955cac5851fe2a
MD5 6a5704a246535ee666b1cf87e10eb53c
SHA1 c9d74edd160314b780a76b5ebfda3c0cfe2e5606
SHA512 e8b2a39bb50a6117738fc593cdb07f8b4a87bc6465fd61de82cd33156ebdf5d714d389b2e74f0d284801e0ac09704a21b46a005ded8ab8ad9b9291bbbb5a43be
SSDEEP 49152:rvRd9FO9MwdFA/w1s+Glqa/KxB2CgfFK1GokWFBB4PD6xABXGfSqnVjxSEhnR3qq:jRd/CcMxgUrXr1j12eJQo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1668	2908	rundll32.exe	28
PID 2908 wrote to memory of 1668	2908	rundll32.exe	28
PID 2908 wrote to memory of 1668	2908	rundll32.exe	28
PID 2908 wrote to memory of 1668	2908	rundll32.exe	28
PID 2908 wrote to memory of 1668	2908	rundll32.exe	28
PID 2908 wrote to memory of 1668	2908	rundll32.exe	28
PID 2908 wrote to memory of 1668	2908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
  2⤵
  PID:1668