df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a

Analysis

max time kernel
137s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Target

virtualkeyboard/qtvirtualkeyboard_openwnn.dll
Size

1.4MB
MD5

cc7ccb45ddd2d36e1925779ef41fe773
SHA1

fc666b091e31cbd4783a286504e4d750c1e7e813
SHA256

470e9355677d2544f295cccf9595e5173d463685d580744e6561dc3d75344051
SHA512

98c1de7f6d10f6750f4d550e676e305af0bcfcb6aee3de5172060295a0163a2f8812817569751883968cdf6e2ae61591da41ee6f1ad9985d0da21ae63e567417
SSDEEP

24576:rQw3akeligd+1vIy/4ucNRT5AyCHc1WZmpRBXKrD:cUjT1v7/4lCHc1teD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4544	940	rundll32.exe	87
PID 940 wrote to memory of 4544	940	rundll32.exe	87
PID 940 wrote to memory of 4544	940	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\virtualkeyboard\qtvirtualkeyboard_openwnn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\virtualkeyboard\qtvirtualkeyboard_openwnn.dll,#1
  2⤵
  PID:4544