87d9def893c67d19627226d54884746dba578ca0bd53a6c3328664dab270061a

Analysis

max time kernel
33s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-11-2022 07:58

Target

v71installer/imageformats/qico.dll
Size

31KB
MD5

7200f8e1af1c6a60501d5fef7772fd0b
SHA1

5f2bac81a60f7fdfbe8b1a01f111660a3614d679
SHA256

35cf0ae6bcd1b8322482d40bf2dd693e276548885284b88e6631ab18a0c2c60e
SHA512

097835d4c8c61c2489e831b31a8bb6f2feea277439d6697b6e3165ccb6e4758986c9a1fa754696da53b6005a041156ff8bc455a71dc31ea799f5891348a07f22
SSDEEP

768:1wLKUeP1ob4OgufLCJGqU2SZ6HseQdDG0Uf2hKT:4KUeP1WyufLCJGqU2SZ6HseQ9Ufz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1160	1340	rundll32.exe	26
PID 1340 wrote to memory of 1160	1340	rundll32.exe	26
PID 1340 wrote to memory of 1160	1340	rundll32.exe	26
PID 1340 wrote to memory of 1160	1340	rundll32.exe	26
PID 1340 wrote to memory of 1160	1340	rundll32.exe	26
PID 1340 wrote to memory of 1160	1340	rundll32.exe	26
PID 1340 wrote to memory of 1160	1340	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\v71installer\imageformats\qico.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\v71installer\imageformats\qico.dll,#1
  2⤵
  PID:1160

memory/1160-54-0x0000000000000000-mapping.dmp

Download
memory/1160-55-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download