df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a

Analysis

max time kernel
150s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Target

styles/qwindowsvistastyle.dll
Size

129KB
MD5

53af56ea898bb82775fdd0f940c429d2
SHA1

5675fd1243ea87e59256b05e5a7c6c64298312ea
SHA256

547606fc8a6b20a2616a4f390c6cf0e7aa713f6ad53bae23c8d1b021885aab0e
SHA512

401f9b346a3da18e750cf26cc05e1013ec8446955344d0e353012abdcb4af4e836515531b1bef4c2fa5a07ec5b41a9cd74c68e39b977e43f9ad1a06ac32fa27e
SSDEEP

3072:Ef08LJXP50EuapXuJWd62ymc7xliHCTBIm2/40mwr6D5RXffv3xf6D:ufFRQLTBImI40mwr6D5RXffv3p6D

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 1344	3048	rundll32.exe	90
PID 3048 wrote to memory of 1344	3048	rundll32.exe	90
PID 3048 wrote to memory of 1344	3048	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\styles\qwindowsvistastyle.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\styles\qwindowsvistastyle.dll,#1
  2⤵
  PID:1344