df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a

Analysis

max time kernel
145s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Target

virtualkeyboard/qtvirtualkeyboard_tcime.dll
Size

277KB
MD5

87dfd74487554475633cd8f1017f866b
SHA1

f885dd31ad332422c65bc3641a69040a73d94d97
SHA256

258d95649ed1a80ba98c234f7bd1380502aebca1e1322c145912f48e0481175d
SHA512

128614016933b3e022c4f99ca2bc9b71f4051384f80dce67cf62c0f9dd90c233d4b5e0d1c3b2c8fe19645f1951ec5df4f3847da8d85be9cc6380e0031808a736
SSDEEP

6144:KwG07HwaPVDXhN9v2UBpx5S6dCF7ZvB8uSgNC86reGT0UUf:a0TBlXBvz55bmZJRSg08rf

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 2308	3536	rundll32.exe	90
PID 3536 wrote to memory of 2308	3536	rundll32.exe	90
PID 3536 wrote to memory of 2308	3536	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\virtualkeyboard\qtvirtualkeyboard_tcime.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\virtualkeyboard\qtvirtualkeyboard_tcime.dll,#1
  2⤵
  PID:2308