cf8a2dfe5f78770f2a3380518fee07d9f0e207da1a0b0d6016266d925fbfc073

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 04:22

Target

qrescd/sample-cd/qres/qresprop.dll
Size

60KB
MD5

e62c871b8c1a7fcdb76a01519bae2921
SHA1

3f757913a0583e0f1e225554c2e4932dc30ef4ae
SHA256

c8e64c7673493c9e806edad70d3e73436d4010cdd51f4c37c1cdc7e18bc551c6
SHA512

a4b0b2cd3d4b5193193e22eab74e786d092296b6c5124154ce8f919b19410542ab5e57d99f8ef94211cbb481d5476258dd0863baf737d5071c3810910e57f541
SSDEEP

768:YQHWjswO4FAK2yhCnuR/Vmz1z5dNXTU9G5fCvl9cl4RpVlLbtoujAoUfn:f2swO4FArpnvBtXTUsdMjcaDDto+Abf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qrescd\sample-cd\qres\qresprop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qrescd\sample-cd\qres\qresprop.dll,#1
  2⤵
  PID:2704