5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324 | Triage

Analysis

max time kernel
1707s
max time network
1177s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:51

Sharing

Report Analysis Logs

General

Target

plugins/imageformats/qico4.dll
Size

28KB
MD5

64d2a9b7d0000bd0b0798927cb069b84
SHA1

020a682498d5634da3b695c988eac942ba3687f3
SHA256

ccaa7ce9f69a7244619838faf58afd5f9118562d77a2a8acad427721884c9685
SHA512

f00d70c69f53dff60814da73cdbeab7ee104250d30cd14fb9ceab0fa07a03dd24ca46e155880463d2f3a276f87079e20456105930c74337d9ff882e36600d981
SSDEEP

768:CoftQ01bCb9l0kPAfm6aX1p1Qs/AtOfKdVR6VsFf1:Cat3Gpl0kem6G1fR/AtOfNsh1

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 3096 wrote to memory of 1284	3096	rundll32.exe	85
PID 3096 wrote to memory of 1284	3096	rundll32.exe	85
PID 3096 wrote to memory of 1284	3096	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\imageformats\qico4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\imageformats\qico4.dll,#1
  2⤵
  PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads