dfca2f1a842aea69a2b0a22ca66fa7852f86259e3da4f576f8ae7fa16f1e9134 | Triage

Analysis

max time kernel
133s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
08-07-2024 09:22

Sharing

Report Analysis Logs

General

Target

swiftshader/libEGL.dll
Size

364KB
MD5

c902cc735f399b557d46d94d561cf274
SHA1

f7727b1f9de4f66d6d55e19c261e2efdc454a846
SHA256

5913efa61eb0985d4f444b03e5b8743f77623b178e310a5514d0c9a042170340
SHA512

a8ba292f35d1732da6dcdcd8583f77c4321aa3892dfecb3ed38b87b738d308a37f0ae06a8bb487f25e375ca2d40744c78b54b03352e531e79c43e09841e28d88
SSDEEP

6144:wH8tQrnPOEkiObeRvvgfj7IHupK3wByVCRWyyf:GqQzOEkiOmzupKgBC

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3964 wrote to memory of 1128	3964	rundll32.exe	rundll32.exe
PID 3964 wrote to memory of 1128	3964	rundll32.exe	rundll32.exe
PID 3964 wrote to memory of 1128	3964	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libEGL.dll,#1
2⤵
PID:1128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads