dfca2f1a842aea69a2b0a22ca66fa7852f86259e3da4f576f8ae7fa16f1e9134

Analysis

max time kernel
138s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
08-07-2024 09:22

Target

swiftshader/libGLESv2.dll
Size

2.7MB
MD5

bf71254ecfc40deab171fec28f1cb818
SHA1

010703fd5a4d663d7579c708fbca9973875f5a85
SHA256

1f8affb378859adaccfc9dce91ea781d144e9472855595bb15882a0f407a856b
SHA512

93591f738711080830559ab630fac1d3e3503e7a33858b9173ae3d5fb2a8a7cb446d5a26fdf430ac15874a618e3c1e761ffb11b4ec545cc4bb94fb7704dfd437
SSDEEP

49152:S0K6kT3DXANt6jYRRhq6wYgteZgxtwWWUNu9UGbTJMqFwPr1byGKjXIvK9JfT9Vi:C6k+Iya+c5Vm56

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1768 wrote to memory of 780	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 780	1768	rundll32.exe	rundll32.exe
PID 1768 wrote to memory of 780	1768	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\swiftshader\libGLESv2.dll,#1
2⤵
PID:780