50623f865bedcea99301e5b33e3c4bedf43e975e6297d5e4291009ef3ecafc35

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 01:55

Target
resources/bin/zenshot/Qt5Gui.dll
Size 5.7MB
Sample240420-cb79taed4y
SHA256 8b12aacf901a17a73e495c7277a1249c56c7c5dbbd0a64b85bda54b9dab043c9
MD5 26e939424e333cb2c71cadd5df76aa40
SHA1 56a2b2fb7d0d11407b21ef5409e768d8735482a6
SHA512 b8d282be49f70a9ec3a4ef9dfd7c9f8df70dabf9d8b13d8363daf0afc2956fc29477c1d6de41e791bb2de678adaef23b992dd1665bace1c9e8ff5d14b86ea66e
SSDEEP 98304:98oNJzx4w24LwWotu+PNlwL9PmEZ23Cec:nBbUuCPwNj2CR
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 3756	4820	rundll32.exe	86
PID 4820 wrote to memory of 3756	4820	rundll32.exe	86
PID 4820 wrote to memory of 3756	4820	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\Qt5Gui.dll,#1
  2⤵
  PID:3756