3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 06:17

Target

$SYSDIR/Qt5RemoteObjects.dll
Size

367KB
MD5

90440e9bb21020744d7ee012c85fc9c7
SHA1

18a53e46ccf66d06fa2c3988121df8ff3252a6a9
SHA256

618b020a57c4e3992119c839d66e64992201378b128b3778f43d864fa9c2adc4
SHA512

c06a98b597ca5111d390557e1cf38b0c52e4291422fa17a2b14cc5b333834d304c8be1b2a1485178a3821d3cfdbea3211266c283b9ee44bdd835966e9088ad70
SSDEEP

6144:0JwhxIO22VJwcSE997BX7PPcYvabtAl6FNJ8n0vxuOIbrz9sMOBETijLDYaGG4Jp:0JwHIO22DwcSE997BX7PPpvSvY0vxFId

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2348 wrote to memory of 2396	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2396	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2396	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2396	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2396	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2396	2348	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 2396	2348	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5RemoteObjects.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5RemoteObjects.dll,#1
2⤵
PID:2396