3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944

Analysis

max time kernel
133s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 06:17

Target

$SYSDIR/Qt/labs/platform/qtlabsplatformplugin.dll
Size

183KB
MD5

ceb1453bd69cd2512dd9f6b8f185bb95
SHA1

c78af8da1dc16d5db8906a68f9e809bcc52331b1
SHA256

14df1dd8ab013e15a5f351d20ef8eaf101e3ed35658a9b14ff615bf2e3a8e2c9
SHA512

733a61c7caf053734cc8f946e0a7a00a0f146a79f42174bcd9395a98203689843b2c4c5dfebec069b1c2d45dd52c5677aab778c7abe54eeb3b34693fda17a244
SSDEEP

3072:IArM8kxxta3hqCdCd44E1f86LtaZ+waPszoX0vxIx+TlrGeoo3p4f+Xm0:2E6otaZ+w4s0X0mx+TlrGeoo3Kf+W0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3116 wrote to memory of 216	3116	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 216	3116	rundll32.exe	rundll32.exe
PID 3116 wrote to memory of 216	3116	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt\labs\platform\qtlabsplatformplugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt\labs\platform\qtlabsplatformplugin.dll,#1
2⤵
PID:216