e7490d25eb3e1553ec66c42b1474a2ff025072f3017eb882f7b15da0379ce9e0

Analysis

max time kernel
1674s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25/02/2024, 20:41

Target

$PLUGINSDIR/imageformats/qicns.dll
Size

43KB
MD5

d617d449bff841e9e56ae5d66733c1f0
SHA1

57f9104c906d88b5193475286b9a1e9d55cd3fe1
SHA256

3587d149b774835aaebf9122945d432cb97a01f923c2bdf45c8ddf7db46fde6f
SHA512

1b4f7be9b650aa5658dde24da392262055b867525f8a2e61a2656c2617651f29dc5b61dd41f57ba84be030616d2060185f4790c7dd4a29d07b1e62af16b7f565
SSDEEP

768:ufWnXICvDmkwWSFmq3ZWCFsE//yuNLozJBOLfJkboetN266R:ufSVvKk+FmhE//yuOzJBOLfJeo86R

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 4444	1592	rundll32.exe	81
PID 1592 wrote to memory of 4444	1592	rundll32.exe	81
PID 1592 wrote to memory of 4444	1592	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\imageformats\qicns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\imageformats\qicns.dll,#1
  2⤵
  PID:4444