a00a54911b40fe81921fb19feb94f5ed4d10735eb273e9eda77edbf27b376ad7

Analysis

max time kernel
141s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 01:18

Target

MegaHackInstaller/bearer/qgenericbearer.dll
Size

43KB
MD5

57f3ffcf6a99abdeca93d0bebd9f05d8
SHA1

f1b7038c4f6cad75b8a6d115255421d60f1de04f
SHA256

44b59c980ca26aca133bd3842155c55eb30630853c3c316e1955415e10b34c0f
SHA512

cbe0ed19d03540ffef93c4028ba7bf170ca82d1bfd15d432c7fb0edf96e450c9ddd85701b3ef52edabac96fd3cb6e3da2eadf4ed1de3907e986e8f3d64dd3b08
SSDEEP

768:EYnMoTheMJroMOENIFanla6PK2Jbga+5+yAXmjkJuDZbjV52dDGFeTUf2hl:Xhe8O6QalaYbga+PjkJuDZbn2VTUfy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 1696	3676	rundll32.exe	83
PID 3676 wrote to memory of 1696	3676	rundll32.exe	83
PID 3676 wrote to memory of 1696	3676	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MegaHackInstaller\bearer\qgenericbearer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MegaHackInstaller\bearer\qgenericbearer.dll,#1
  2⤵
  PID:1696