df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a

Analysis

max time kernel
146s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Target

virtualkeyboard/qtvirtualkeyboard_thai.dll
Size

31KB
MD5

a17dfea4bcbcf26c2ab224380f2de706
SHA1

5ea88cf628dd511d2989c9deeaf739369eb60262
SHA256

1e20b52a115af694124aaaae674ee2fd66dab98b44a92f17fcbd66760017e65b
SHA512

ccd671a912c20a64d3cb458d7aa6f55ad003a8d933523c51c792446d323797d990fd1fae1dfbb92eeca7ee39c9316e7a01a015cfde50c39711ef1e4067b36d1e
SSDEEP

768:q/+XnKCN12s0cWMlCgOw1XUchidDGDwUf2h9G:hnKCN128lC01XUchiawUf1

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 3084	1088	rundll32.exe	89
PID 1088 wrote to memory of 3084	1088	rundll32.exe	89
PID 1088 wrote to memory of 3084	1088	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\virtualkeyboard\qtvirtualkeyboard_thai.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\virtualkeyboard\qtvirtualkeyboard_thai.dll,#1
  2⤵
  PID:3084