df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a

Analysis

max time kernel
196s
max time network
311s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Target

virtualkeyboard/qtvirtualkeyboard_pinyin.dll
Size

1.1MB
MD5

84a5f5536f883f8aaa061182cfc99495
SHA1

b6a7020d9830633792cdd17f20d4e882e66ad7b5
SHA256

6da5a622ff63f876dddefc503aeb51cd5d1329b106e55c7e56fe13659cd6f7c6
SHA512

949f49a7687659bca43444514f4f2960b5c5576ce29bdcf39752ed1ac2568ea7ec1fe4dbf32e86b36b39d97f6d4891fa5d16723d5a15f70936c7df6b9615bb97
SSDEEP

12288:aF6MEiJ0wKHcX1CwtOO0BfZLP4w8zbax9T+5JSxHbxuTlpFgDpVS+VSemW1+Dj:ORs01VtOOC5v8z2E/Y7x4lsD3S+Lw

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 3572	3196	rundll32.exe	95
PID 3196 wrote to memory of 3572	3196	rundll32.exe	95
PID 3196 wrote to memory of 3572	3196	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\virtualkeyboard\qtvirtualkeyboard_pinyin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\virtualkeyboard\qtvirtualkeyboard_pinyin.dll,#1
  2⤵
  PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:3564