0d8e2f68ce537be331fb8776d6d2e118da87bb31fd7f266392d382f92dc5193d

Analysis

max time kernel
138s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:05

Target

Qt5SerialPort.dll
Size

64KB
MD5

76d5e06e7cd3dda770e73b311d908334
SHA1

01fb750d2a7dc02baa8dc5189354325a9d17c131
SHA256

de57f02ab8dee19889a13be9976e90ce0aa2f1b7db2e09d3608b465faabed167
SHA512

547f550759caab21473d5e239629e00542094e3214c7a05ae5883071129670ce5535b35c81e9045dea72db8bbbb6fa3953039b3daaee4f2f922a68e3f7b864ac
SSDEEP

768:tp8CUcv41KI1YRmTQTbjNuZOe/V9+A906sko7igZnU0Vkh2lWkPiyk38h2psG/pH:Eyv4GR5DOy7iSf+hG1ZX7Wjl5VUUfaM

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3588 wrote to memory of 3936	3588	rundll32.exe	rundll32.exe
PID 3588 wrote to memory of 3936	3588	rundll32.exe	rundll32.exe
PID 3588 wrote to memory of 3936	3588	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5SerialPort.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5SerialPort.dll,#1
2⤵
PID:3936