0c21133a8b332f0462ae88430a615fce1447cc49f8b18fee274baa64b6d0c8cd | Triage

Analysis

max time kernel
143s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
17-02-2024 05:28

Sharing

Report Analysis Logs

General

Target

UltimMC/imageformats/qsvg.dll
Size

28KB
MD5

7eb5b428de2fd5ce7f361bbf3d6aada4
SHA1

318acc5132492347727bde7ed70516150144b140
SHA256

c818b37d77c84e3a9963a761bae3eefc73cccd3485ee6cb1c085c670041e9c59
SHA512

681fb8a700aee5f44cf1f328c2fea157a98dab12e287f686d408584b5096ac262cb5cd2b2ff1f3c1b6e55d374ade2236118f41ec9c14fbec7014aae0683c1e5d
SSDEEP

384:0F2Z2Eg8ESscKYkiluz0RdysDv2IWsTmqK5J5:SqESTnDRbWH1J

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3632 wrote to memory of 1536	3632	rundll32.exe	rundll32.exe
PID 3632 wrote to memory of 1536	3632	rundll32.exe	rundll32.exe
PID 3632 wrote to memory of 1536	3632	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\imageformats\qsvg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3632

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\imageformats\qsvg.dll,#1
2⤵
PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads