59202d95bbcb9a85624ae56b93adeecc94b476a0131fe4670b718439ae4da1c9

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 01:09

Target
$PLUGINSDIR/sqxq.dll
Size 27KB
Sample240403-bhz2cabc3t
SHA256 afa62df6a2905e93ab1f59b5bd24856a88f735cd3930e7701a22a1988d3d475c
MD5 3d2e7f16f238ac79b3d0e21a753ae79e
SHA1 ee53d37f5f1a86ddb7e1b6faa063d4afbabcf771
SHA512 e9764e730f2b3eea3d769649164a41f10b8e0be865e8a76ba65220b20d8b122bb6dad1a2be8b87fe861960eecfb11b9f836ac93d17fcb218c0201d6a17545ea5
SSDEEP 768:1oFOzbc9RWl6YOFbzdAk3anbKgPSUm6At0wvM1W:6UbUWl0aUaVAN0wvIW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3800	5112	rundll32.exe	94
PID 5112 wrote to memory of 3800	5112	rundll32.exe	94
PID 5112 wrote to memory of 3800	5112	rundll32.exe	94
PID 3800 wrote to memory of 1648	3800	rundll32.exe	99
PID 3800 wrote to memory of 1648	3800	rundll32.exe	99
PID 3800 wrote to memory of 1648	3800	rundll32.exe	99

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sqxq.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sqxq.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\sqxq.dll,#1
    3⤵
    PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3780 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:3672

memory/3800-0-0x0000000075470000-0x000000007547A000-memory.dmp

Download

memory/3800-1-0x0000000075470000-0x000000007547A000-memory.dmp

Download