d706a6436424da221bb5d580378262a4e6545e1fb6fa13bd980a3a315a05d0fa | Triage

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-es
resource tags

arch:x64arch:x86image:win10v2004-20231222-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
11-02-2024 23:23

Sharing

Report Analysis Logs

General

Target

MultiMC/imageformats/qsvg.dll
Size

28KB
MD5

7eb5b428de2fd5ce7f361bbf3d6aada4
SHA1

318acc5132492347727bde7ed70516150144b140
SHA256

c818b37d77c84e3a9963a761bae3eefc73cccd3485ee6cb1c085c670041e9c59
SHA512

681fb8a700aee5f44cf1f328c2fea157a98dab12e287f686d408584b5096ac262cb5cd2b2ff1f3c1b6e55d374ade2236118f41ec9c14fbec7014aae0683c1e5d
SSDEEP

384:0F2Z2Eg8ESscKYkiluz0RdysDv2IWsTmqK5J5:SqESTnDRbWH1J

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4868 wrote to memory of 4540	4868	rundll32.exe	rundll32.exe
PID 4868 wrote to memory of 4540	4868	rundll32.exe	rundll32.exe
PID 4868 wrote to memory of 4540	4868	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qsvg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiMC\imageformats\qsvg.dll,#1
2⤵
PID:4540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads