e7490d25eb3e1553ec66c42b1474a2ff025072f3017eb882f7b15da0379ce9e0

Analysis

max time kernel
1382s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25-02-2024 20:41

Target

$PLUGINSDIR/imageformats/qico.dll
Size

35KB
MD5

77b5eee567d88078024e3b535d6196f1
SHA1

db155287e3a3fcff2d280b5a4aa555784c2bea91
SHA256

ae2d373da197c94fd6aff5b56baf3df754722926af4f71279688ce563fe6ef31
SHA512

811b1654a0b17eada09e37d4d29a3297d5aaf9f2eae1f3cf48cb6b7c5d36f28450ca80084aec94765bee0b02c03854c3e489327911de9d96f8189a6e92c6648c
SSDEEP

768:RianaRH+EpYy3kVCpwnNcToT5uiLsffJkboQDN266W:Aan6+EpJoCpwnNcsT5uQsffJeoM6W

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1400 wrote to memory of 1292	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1292	1400	rundll32.exe	rundll32.exe
PID 1400 wrote to memory of 1292	1400	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\imageformats\qico.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\imageformats\qico.dll,#1
2⤵
PID:1292