87d9def893c67d19627226d54884746dba578ca0bd53a6c3328664dab270061a

Analysis

max time kernel
87s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2023 17:32

Target

v71installer/imageformats/qgif.dll
Size

33KB
MD5

e3a1338efadabb9fc23d955af9a7e070
SHA1

dfbe82b183fff002a2e841d73474c78f646fdba2
SHA256

f1fa3bfeea6a600f2c6d209775154cee349b7f687cb4f7213a8cad8870dbb812
SHA512

0413a6116e227fa6a3dd7da6fa4bb8db59ed64fc16e37bfa49ca28c687fe791941b3a23193796eb0ece458e87f9f78f587b3a1fe0f188b63b9148037997df1a2
SSDEEP

768:aL5MPkjurnzyuVlfehyScQeOYGuOU9OOHhTNAYFdDGzUf2hW:aNYnzyuLeEfQeFGuOU9OOHhZAYFOUf5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4188	2656	rundll32.exe	78
PID 2656 wrote to memory of 4188	2656	rundll32.exe	78
PID 2656 wrote to memory of 4188	2656	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\v71installer\imageformats\qgif.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\v71installer\imageformats\qgif.dll,#1
  2⤵
  PID:4188