87d9def893c67d19627226d54884746dba578ca0bd53a6c3328664dab270061a

Analysis

max time kernel
95s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2023, 17:32

Target

v71installer/imageformats/qtga.dll
Size

26KB
MD5

367c723591fde64c38202d4c0f5ecfde
SHA1

c13d74f417601c656f343f00d15e56517ee03b6a
SHA256

ccd620e74045d9c9157903120140b97419cbbe91fd43337e640c67cd4522072a
SHA512

31c084ba00e094e30c6f912ecd045e19c4451d8783a80dc99b99098f84c5500665a35ac901b0fde84d04df898ad67448e83539a7daa4928e8c78f798b359b256
SSDEEP

384:kg8gKOwVg6VjbFnOfEIzPMoVhWyrsdnyBSxQrrVIyndDGdEDgf2hR:kPxOQXOfEnoVh5/BSxQrxIYdDGKUf2hR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 464	1392	rundll32.exe	81
PID 1392 wrote to memory of 464	1392	rundll32.exe	81
PID 1392 wrote to memory of 464	1392	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\v71installer\imageformats\qtga.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\v71installer\imageformats\qtga.dll,#1
  2⤵
  PID:464