e7490d25eb3e1553ec66c42b1474a2ff025072f3017eb882f7b15da0379ce9e0

Analysis

max time kernel
1783s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25/02/2024, 20:41

Target

$PLUGINSDIR/imageformats/qgif.dll
Size

35KB
MD5

e070dbf1a9253bde7910e040dfd5d4bc
SHA1

43f396528d643bd2c9fd8e1b63c4151bbb23c980
SHA256

7ac66b0c813585b7cd3645ad3bcab0b225006cee9076b05a21cb6b8db176462d
SHA512

317af40137f8f1d475349a926067bfb6b776c0e26352e164d6cf1fa95293b865ca6e07cf3cb305eff122c1033cd3cd7e2931b8c0083424ebc91be111d6b89a8d
SSDEEP

768:HSkyMP9EKMNatQl74W0LLc2G864D+9uMUo+ua8NcqUfJkboekNN266T:HSnh4i4DLg2zD+9uM3+uaGfUfJeoZ6T

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 3852	3636	rundll32.exe	56
PID 3636 wrote to memory of 3852	3636	rundll32.exe	56
PID 3636 wrote to memory of 3852	3636	rundll32.exe	56

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\imageformats\qgif.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\imageformats\qgif.dll,#1
  2⤵
  PID:3852