87d9def893c67d19627226d54884746dba578ca0bd53a6c3328664dab270061a

Analysis

max time kernel
95s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2022, 07:58

Target
v71installer/imageformats/qgif.dll
Size 33KB
Sample221105-jtxpcsgggr
SHA256 f1fa3bfeea6a600f2c6d209775154cee349b7f687cb4f7213a8cad8870dbb812
MD5 e3a1338efadabb9fc23d955af9a7e070
SHA1 dfbe82b183fff002a2e841d73474c78f646fdba2
SHA512 0413a6116e227fa6a3dd7da6fa4bb8db59ed64fc16e37bfa49ca28c687fe791941b3a23193796eb0ece458e87f9f78f587b3a1fe0f188b63b9148037997df1a2
SSDEEP 768:aL5MPkjurnzyuVlfehyScQeOYGuOU9OOHhTNAYFdDGzUf2hW:aNYnzyuLeEfQeFGuOU9OOHhZAYFOUf5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2004	4232	rundll32.exe	79
PID 4232 wrote to memory of 2004	4232	rundll32.exe	79
PID 4232 wrote to memory of 2004	4232	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\v71installer\imageformats\qgif.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\v71installer\imageformats\qgif.dll,#1
  2⤵
  PID:2004