a00a54911b40fe81921fb19feb94f5ed4d10735eb273e9eda77edbf27b376ad7

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 01:18

Target

MegaHackInstaller/imageformats/qico.dll
Size

31KB
MD5

7200f8e1af1c6a60501d5fef7772fd0b
SHA1

5f2bac81a60f7fdfbe8b1a01f111660a3614d679
SHA256

35cf0ae6bcd1b8322482d40bf2dd693e276548885284b88e6631ab18a0c2c60e
SHA512

097835d4c8c61c2489e831b31a8bb6f2feea277439d6697b6e3165ccb6e4758986c9a1fa754696da53b6005a041156ff8bc455a71dc31ea799f5891348a07f22
SSDEEP

768:1wLKUeP1ob4OgufLCJGqU2SZ6HseQdDG0Uf2hKT:4KUeP1WyufLCJGqU2SZ6HseQ9Ufz

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2256	2268	rundll32.exe	28
PID 2268 wrote to memory of 2256	2268	rundll32.exe	28
PID 2268 wrote to memory of 2256	2268	rundll32.exe	28
PID 2268 wrote to memory of 2256	2268	rundll32.exe	28
PID 2268 wrote to memory of 2256	2268	rundll32.exe	28
PID 2268 wrote to memory of 2256	2268	rundll32.exe	28
PID 2268 wrote to memory of 2256	2268	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MegaHackInstaller\imageformats\qico.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MegaHackInstaller\imageformats\qico.dll,#1
  2⤵
  PID:2256