47e810d2661b47d7419c6ca876feeeaa900ae86880c00627a218d2c4d918927f

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 02:19

Target

lib/PySide2.QtSerialPort.dll
Size

103KB
MD5

e1a2acccb8678afab6aa1a9c26de1f9b
SHA1

122c2bdc38cf0a362315f8dcdfaed3200eb35155
SHA256

6ab26cd4b404b4c1384391c3cafb8cb5813f9c7554e1ee210f771c8d5e946b30
SHA512

dc6152386e558e219e8c4b48eeb95176b3e4e89c4f867cb188c9a73457569b1f22f4a5c392408cc8713c97d046f47f609f1edb582540d458f3fefc38d84bfe9a
SSDEEP

1536:qS272mR3w91m1CBcDXJuFT3wCGqOtzIY+fE4R1+Z1LUO/xGgXW5vngKOonPV6TF:x272mR3UmFFCGqOtT/HUO/xG0KoKjiF

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1208	2124	rundll32.exe	28
PID 2124 wrote to memory of 1208	2124	rundll32.exe	28
PID 2124 wrote to memory of 1208	2124	rundll32.exe	28
PID 2124 wrote to memory of 1208	2124	rundll32.exe	28
PID 2124 wrote to memory of 1208	2124	rundll32.exe	28
PID 2124 wrote to memory of 1208	2124	rundll32.exe	28
PID 2124 wrote to memory of 1208	2124	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtSerialPort.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtSerialPort.dll,#1
  2⤵
  PID:1208