198c817204d7e72e30f7c7778d88c24898e653e54a08bc9ee9e9ecbbe8e79732

Resubmissions

09/01/2023, 01:55

09/01/2023, 01:49

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2023, 01:49

Target

MultiMC/imageformats/qico.dll
Size

34KB
MD5

6c3e20e5aea84bb3ea7dfed04d47e359
SHA1

40d1d2ff70a2cb86b59f9226025575b00adab004
SHA256

300cc9b62dbd6fd174e548f68fb06d5195de85d9084887856ce70c30421d05ea
SHA512

a4a201d6008f3f47ab650dd0e6266a95895e31259ba52ddfcbe07aec632e39ce0912ebf30e7b62a9c0155b3d13f898797923e560f90fe78ac79c67f2071e7233
SSDEEP

384:48oL/r5InNQEVQAfZ9EJ0chhCxI8RqnrC+VnhkjqIQ5Cxjl95hj1V2u:01EAqcuxIILCkpOeltb2u

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1184	4800	rundll32.exe	82
PID 4800 wrote to memory of 1184	4800	rundll32.exe	82
PID 4800 wrote to memory of 1184	4800	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qico.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qico.dll,#1
  2⤵
  PID:1184