4d085c99ff295582f3aba758345adec2527f11841cdaa78f38fccd200c38167f | Triage

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 22:07

Sharing

Report Analysis Logs

General

Target

$PROGRAM_FILES/QuickTime/Plugins/npqtplugin4.dll
Size

124KB
MD5

94cde43a95b3e116f2852c8d9e24786c
SHA1

b355918e0517b32a1e74d5510abb3323238e6075
SHA256

f17bbf2b931fad801490c7568e723acaa90786ba769210ca2547b71c6fbe4ac8
SHA512

d72138a22adb7ede962b203ffc5715fcf7d1278c7609f98fa451c28305fb4aa30be9f7cd3b44f992ae1dc184836ba75ff6cbafa4855a337ffc30af9f0cd85fa6
SSDEEP

3072:SE/wppQSI3u3EdsjIqjJYlcPrLcnc3Tv5C/U:SzzrUu3EdIrXV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1720	1932	rundll32.exe	28
PID 1932 wrote to memory of 1720	1932	rundll32.exe	28
PID 1932 wrote to memory of 1720	1932	rundll32.exe	28
PID 1932 wrote to memory of 1720	1932	rundll32.exe	28
PID 1932 wrote to memory of 1720	1932	rundll32.exe	28
PID 1932 wrote to memory of 1720	1932	rundll32.exe	28
PID 1932 wrote to memory of 1720	1932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\QuickTime\Plugins\npqtplugin4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES\QuickTime\Plugins\npqtplugin4.dll,#1
  2⤵
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads