df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a

Analysis

max time kernel
137s
max time network
317s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Target

qmltooling/qmldbg_quickprofiler.dll
Size

28KB
MD5

2ea6df682c77a0e744616334fdaa03da
SHA1

5ae14f05a79869b79ebf7bf1e78ff77c717e57a6
SHA256

43bd861a6a64712e2c77be8cdd8a9bba7c068749a3cc824ffd14359f52c0b5d5
SHA512

ec71a4912979b2273b6e2e0a6e0ab458da2276e77076a77a4a4057b4eac54431d782640a01d1cdd02f27ba310cc4bb8915c735375a06595f46e9e192e0b985f0
SSDEEP

768:wHhZBz8gerWblJvJtXepGqUsngSNdkdDGj9tUf2h4:eZmgerWbBtupGqZngSnkQ9tUfH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 4928	3092	rundll32.exe	87
PID 3092 wrote to memory of 4928	3092	rundll32.exe	87
PID 3092 wrote to memory of 4928	3092	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qmltooling\qmldbg_quickprofiler.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qmltooling\qmldbg_quickprofiler.dll,#1
  2⤵
  PID:4928