5ea85ac874b09f5b8d48f1490926fa2997ea570a6c62ecdd901f883dd24dc792

Analysis

max time kernel
125s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 22:31

Target
qmsd.dll
Size 40KB
Sample240213-2ffg2aae9z
SHA256 e7bc2a0ac4b038502e8fd68e85f98f784e9de07904ce24eda583660d612834b9
MD5 5050b48b952a5df457c4f2e0dca42a05
SHA1 d8b11a0f5cae4f9230b9053999560f385295cdc7
SHA512 77017fe06ea5c9490dcd60160844bf82587ad3eef6b8b8bc20f291e539428aac2b1193877e0ebe8d2f3f910f1beaf529dbf370afb1f72106659e1ee2346a3280
SSDEEP 768:URoKWHILFL5a+5HTd0nbCBwJRL1vZIsgbULHvsc:Bu/V5HR1wD4bUTB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 1596	3132	rundll32.exe	85
PID 3132 wrote to memory of 1596	3132	rundll32.exe	85
PID 3132 wrote to memory of 1596	3132	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qmsd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qmsd.dll,#1
  2⤵
  PID:1596