85c9b01515c4f19f797d8753d7187f463b3c742012bd22d3ea84c222ea7f5a76

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
24/10/2023, 01:12

Target

MultiMC/imageformats/qico.dll
Size

35KB
MD5

2c32188d9388b06ec91170e4461913ab
SHA1

082689789ff54cacf94b0f171c762df512c8a786
SHA256

63f7f73d9bd956ca55b80ce29d24c0a1da1a126885d45473e5779ca78a709dcb
SHA512

57286e87e9a013229db863c152d41b7af821b8afa7f84259f58f7089a947ca3771d526aada88212fcbb235209b6b504a489a5c43c4ba0b2a77e1f31e882e9262
SSDEEP

384:JUev3snLkJqIN1v5dqY3M1lNRa16NQkgcPkRu7xR3xr+i1AxwWTTVqI5SEwZY1:l2XqL0IexWkg0k0dR31fWdqqSEwZY1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1984	1748	rundll32.exe	1
PID 1748 wrote to memory of 1984	1748	rundll32.exe	1
PID 1748 wrote to memory of 1984	1748	rundll32.exe	1
PID 1748 wrote to memory of 1984	1748	rundll32.exe	1
PID 1748 wrote to memory of 1984	1748	rundll32.exe	1
PID 1748 wrote to memory of 1984	1748	rundll32.exe	1
PID 1748 wrote to memory of 1984	1748	rundll32.exe	1

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qico.dll,#1
1⤵
PID:1984

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qico.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748