a00a54911b40fe81921fb19feb94f5ed4d10735eb273e9eda77edbf27b376ad7

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 01:18

Target

MegaHackInstaller/imageformats/qtga.dll
Size

26KB
MD5

367c723591fde64c38202d4c0f5ecfde
SHA1

c13d74f417601c656f343f00d15e56517ee03b6a
SHA256

ccd620e74045d9c9157903120140b97419cbbe91fd43337e640c67cd4522072a
SHA512

31c084ba00e094e30c6f912ecd045e19c4451d8783a80dc99b99098f84c5500665a35ac901b0fde84d04df898ad67448e83539a7daa4928e8c78f798b359b256
SSDEEP

384:kg8gKOwVg6VjbFnOfEIzPMoVhWyrsdnyBSxQrrVIyndDGdEDgf2hR:kPxOQXOfEnoVh5/BSxQrxIYdDGKUf2hR

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 4272	2448	rundll32.exe	84
PID 2448 wrote to memory of 4272	2448	rundll32.exe	84
PID 2448 wrote to memory of 4272	2448	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MegaHackInstaller\imageformats\qtga.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MegaHackInstaller\imageformats\qtga.dll,#1
  2⤵
  PID:4272