87d9def893c67d19627226d54884746dba578ca0bd53a6c3328664dab270061a

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2022, 07:58

Target
v71installer/imageformats/qico.dll
Size 31KB
Sample221105-jtxpcsgggr
SHA256 35cf0ae6bcd1b8322482d40bf2dd693e276548885284b88e6631ab18a0c2c60e
MD5 7200f8e1af1c6a60501d5fef7772fd0b
SHA1 5f2bac81a60f7fdfbe8b1a01f111660a3614d679
SHA512 097835d4c8c61c2489e831b31a8bb6f2feea277439d6697b6e3165ccb6e4758986c9a1fa754696da53b6005a041156ff8bc455a71dc31ea799f5891348a07f22
SSDEEP 768:1wLKUeP1ob4OgufLCJGqU2SZ6HseQdDG0Uf2hKT:4KUeP1WyufLCJGqU2SZ6HseQ9Ufz
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 3392	4576	rundll32.exe	80
PID 4576 wrote to memory of 3392	4576	rundll32.exe	80
PID 4576 wrote to memory of 3392	4576	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\v71installer\imageformats\qico.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\v71installer\imageformats\qico.dll,#1
  2⤵
  PID:3392