df430e88e62b426b7c75ba29eb28eff3b77714999a28c6f9aa9172085f78cd3a | Triage

Analysis

max time kernel
252s
max time network
263s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 00:18

Sharing

Report Analysis Logs

General

Target

qmltooling/qmldbg_profiler.dll
Size

61KB
MD5

4f1c656f4c1f9ef9a8d5a4307beda10e
SHA1

7d45e3fb9e56e0517435e6b40592781ba417c8b4
SHA256

99be20dfd493a12528a844b8b5f02d17e306d2a7cebeadeec08d620c0311f592
SHA512

bf5661c950b8adc8111311d674a78195c6c23672edafd348e0dc940cb9adbc6186dbaa2327cf9a51db0af96102bdee41b8045bc0d12ae3d8adeaa20b82205ee7
SSDEEP

1536:74d8mAKz+746tOVkcKtrfOD0GWW+2bHPI6L4TMUfm:Ud8x74hVCfc0GWr2bHb4T+

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2660	2436	rundll32.exe	90
PID 2436 wrote to memory of 2660	2436	rundll32.exe	90
PID 2436 wrote to memory of 2660	2436	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qmltooling\qmldbg_profiler.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qmltooling\qmldbg_profiler.dll,#1
  2⤵
  PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads