31e8dda13e7a2e04829a653f8d30ddea96763b4045c6f9123160539cbf7b1e14

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 11:34

Target

$SYSDIR/Qt/labs/folderlistmodel/qmlfolderlistmodelplugin.dll
Size

52KB
MD5

975695f687e04212502f30d47a4e5c67
SHA1

66dc9ef147effcfe13effa6cd1cca5f845472ec6
SHA256

e6ce9a9c103a2df6aa56b3638da03047717e25cff0f2fca38a1dfb59a20e4413
SHA512

4ad2fb0c1446ec4f25f826667c74d8963c70e883d120143b34cc2b8764ab1809dc25b120c5864dac3a4db4beed4b5cd61b3b253e1f2cb28ec1c15df97d452fd2
SSDEEP

1536:WnSGVMmIejp12LcSJFijQjNEcSlW1GKTluxWSWF1Ufm:WnH6mIUSHSlNkluxW/Fl

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4292 wrote to memory of 1864	4292	rundll32.exe	rundll32.exe
PID 4292 wrote to memory of 1864	4292	rundll32.exe	rundll32.exe
PID 4292 wrote to memory of 1864	4292	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt\labs\folderlistmodel\qmlfolderlistmodelplugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt\labs\folderlistmodel\qmlfolderlistmodelplugin.dll,#1
2⤵
PID:1864