acac2e1bad58381fb4fa36027b7e9e8fb15158ef32f36533953f0e24068fe634

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 07:18

Target

QtGui4.dll
Size

9.5MB
MD5

8bb9f50b08dabf0cf42d4b000620a4f5
SHA1

b8809f3cb81dfa3bd43abf8f3211a8d2a6eda4e4
SHA256

8c902026f80e5deb36ae52b985073e6dc0506a20673bc7358cfff6e9809e89f0
SHA512

3a5f73592faf70652cbfddef3d3d40725c8167960f81fb8fb425e1407282d5aaa6af592b56b2563bdf5a5858ebb65a606e5080382419edcfc42a201134e168b5
SSDEEP

196608:jtnORXc3lKCIfMMnGzuU6H/gsXRrk5VaNI2Waf+n4wUiPMw9AOIrJn1NCXVQMuxf:NWVGzuU6H/gsXRrk5VaW2WQ+4wUiPMaM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3944	4848	rundll32.exe	82
PID 4848 wrote to memory of 3944	4848	rundll32.exe	82
PID 4848 wrote to memory of 3944	4848	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtGui4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtGui4.dll,#1
  2⤵
  PID:3944