df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a

Analysis

max time kernel
132s
max time network
317s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Target

qmltooling/qmldbg_tcp.dll
Size

25KB
MD5

d3d6429e0bab0dae84929599deffdb5d
SHA1

d02b69d938d4eae917aedcb978ef7f184723ac05
SHA256

38c79b70680ddfd823968551a85e1fd1081f213c0cc65d0f6593beeaa6bc5260
SHA512

22d4e5d8377ff396072b941adcdecfe1180ae22d1259db1a10d34793d6e7a84b48f10f4a1fd2b00f76dc27cd8724a968245ca7edfaa9392cc7952b7a7d5efaca
SSDEEP

384:ox6BLeacqjsQJxcENj7TfNe77myDT4onaAXuIDgZ3ndDG5Dgf2hHb:ox6BLgqBcEG/TohIDgZ3dDG5Uf2h7

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3248	4536	rundll32.exe	87
PID 4536 wrote to memory of 3248	4536	rundll32.exe	87
PID 4536 wrote to memory of 3248	4536	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qmltooling\qmldbg_tcp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qmltooling\qmldbg_tcp.dll,#1
  2⤵
  PID:3248