3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944

Analysis

max time kernel
109s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 06:17

Target

$SYSDIR/Qt5QmlWorkerScript.dll
Size

47KB
MD5

52aa72cc6dbd67f5f203afd72ba0df92
SHA1

a52ebb259b3e1d1f9dbd9c359e0bceb469c3b8a4
SHA256

42faea919d50c5112c6a24e2e40feee6eaabb08dfd1330bb8b91fa249fb8b2be
SHA512

31a01095fa9c8bc4b420c1463e77fcea732637924c74662c0506aa13551d7e267fc7d2a99189b354aa2077bbb7a4f94322ea686031377825dc69476189c472fa
SSDEEP

768:NKNxAextI4fEp+7vSOKjBo5XqT1nsR13uT2B+0dDGgyUf2hT:NGDTINpiXOB0qT1nsR1eT2B+0NyUfu

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5100 wrote to memory of 1652	5100	rundll32.exe	rundll32.exe
PID 5100 wrote to memory of 1652	5100	rundll32.exe	rundll32.exe
PID 5100 wrote to memory of 1652	5100	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5QmlWorkerScript.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5QmlWorkerScript.dll,#1
2⤵
PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:3972