3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 06:17

Target

$SYSDIR/Qt/labs/settings/qmlsettingsplugin.dll
Size

36KB
MD5

33b2530c33708b928c93ad00f762b0e1
SHA1

f22c8871395acd0311fe8bae8b469e214d546ead
SHA256

0c9913f95e28ae805297021095532bd72ddc6f42e29307a060f2a502110b7e8d
SHA512

567c64f159e280c5be2f51b3072ae80fea5f0048a4f4b4b4978b74670372166a3286d92de14410c8e1e34a583c44226a85903cd9b0f22bff039f8becf1c72d76
SSDEEP

768:eo7BK1Ha15mcMzIvW8mewzxpoGa1ohnvyEgPURdDGMFFjUf2hE/:N7BK1Ha15mr0mew9poGa1o9vyEgPIfT6

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2156 wrote to memory of 1184	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1184	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1184	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1184	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1184	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1184	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 1184	2156	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt\labs\settings\qmlsettingsplugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt\labs\settings\qmlsettingsplugin.dll,#1
2⤵
PID:1184