2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584 | Triage

Analysis

max time kernel
131s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:25

Sharing

Report Analysis Logs

General

Target

iconengines/qsvgicon.dll
Size

53KB
MD5

bf1715c5545462372fd5cfc54d4c9e07
SHA1

45a3cabce634876b9747181c6db733bccfe3f075
SHA256

c1775755b82a76aaa9ed6559512888bf2280a5644557a82e600a06c7dbd31204
SHA512

bc05b67ca0b5933c2dcfdf33ca58e81630d6887b78794c8ac59e8a5fcda98635d80fe3f02fb29e662dba167690d3797fed2467be2f0e95de0d763dea4505136a
SSDEEP

1536:s+nPkrG78F1fRSTiB3qYzJ9RbNZ4FDt93hsZ2:s+nPkrGAFCo3qYzJ9RbNZApwZ2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1704 wrote to memory of 2252	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 2252	1704	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 2252	1704	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iconengines\qsvgicon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iconengines\qsvgicon.dll,#1
2⤵
PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...