e7490d25eb3e1553ec66c42b1474a2ff025072f3017eb882f7b15da0379ce9e0

Analysis

max time kernel
1324s
max time network
1884s
platform
windows10-2004_x64
resource
win10v2004-20240221-uk
resource tags

arch:x64arch:x86image:win10v2004-20240221-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25-02-2024 20:41

Target

$PLUGINSDIR/styles/qwindowsvistastyle.dll
Size

129KB
MD5

cea2589b96f6a9f02fccc0bc0786965f
SHA1

dc115c308579d59f31346b3535fbc3e0338e0dd8
SHA256

a0b0177a40b1c74ac79bf31c9f26ab0770d54c2297d68a53d289c48ff5b23edb
SHA512

7865d1ee088cc880670bebb90ed13f5bb55b14affc98dac1ff9bdfcc94aacc84b1379dedcd1ffc992b8f45df40434bdb1c3a3e396410f2f292fd9c83d7d2c338
SSDEEP

3072:9d7ZeiD6e0qwpyHHJuw4+mrZNNF+54a9YDU9wRpWi4m7JRBBT30TlaaAjl/Y4WRt:xdb0qLJu3ZonW4GJPBIxaaAjl/Y4WRv1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1652 wrote to memory of 2220	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 2220	1652	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 2220	1652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\styles\qwindowsvistastyle.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\styles\qwindowsvistastyle.dll,#1
2⤵
PID:2220