df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a

Analysis

max time kernel
142s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Target

qmltooling/qmldbg_preview.dll
Size

75KB
MD5

267bab8d99772ba5e8eacc0ba9a4337f
SHA1

019cb909957e4e8fdfb7dfd8389c92ba31495c3d
SHA256

38ddfa76f6fe31cd4a11334772d05a3e26b1afae6fe84e0174e5db930ef42970
SHA512

b4d872dbca7c2f33e48065f8504b45d5df14ebfc7e9e69d8fbe3d76a74812a10d848f671320bcdfcf9c4127f6548c58f5cf2fbc5987e78e9b723d1b911408873
SSDEEP

1536:jy+L6sZC3q/lMN+hvS6Fgpk2Ljmi9GZy8qQjfPYP9oDUD8lHUfAb:jy66I6N+BSZpkUmi9GZtqQ4oDXlP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 208	380	rundll32.exe	90
PID 380 wrote to memory of 208	380	rundll32.exe	90
PID 380 wrote to memory of 208	380	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qmltooling\qmldbg_preview.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qmltooling\qmldbg_preview.dll,#1
  2⤵
  PID:208