3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944

Analysis

max time kernel
134s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 06:17

Target

$SYSDIR/Qt/labs/folderlistmodel/qmlfolderlistmodelplugin.dll
Size

52KB
MD5

975695f687e04212502f30d47a4e5c67
SHA1

66dc9ef147effcfe13effa6cd1cca5f845472ec6
SHA256

e6ce9a9c103a2df6aa56b3638da03047717e25cff0f2fca38a1dfb59a20e4413
SHA512

4ad2fb0c1446ec4f25f826667c74d8963c70e883d120143b34cc2b8764ab1809dc25b120c5864dac3a4db4beed4b5cd61b3b253e1f2cb28ec1c15df97d452fd2
SSDEEP

1536:WnSGVMmIejp12LcSJFijQjNEcSlW1GKTluxWSWF1Ufm:WnH6mIUSHSlNkluxW/Fl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2024 wrote to memory of 2720	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2720	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2720	2024	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt\labs\folderlistmodel\qmlfolderlistmodelplugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt\labs\folderlistmodel\qmlfolderlistmodelplugin.dll,#1
2⤵
PID:2720