31e8dda13e7a2e04829a653f8d30ddea96763b4045c6f9123160539cbf7b1e14

Analysis

max time kernel
135s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 11:34

Target

$SYSDIR/Qt/labs/platform/qtlabsplatformplugin.dll
Size

183KB
MD5

ceb1453bd69cd2512dd9f6b8f185bb95
SHA1

c78af8da1dc16d5db8906a68f9e809bcc52331b1
SHA256

14df1dd8ab013e15a5f351d20ef8eaf101e3ed35658a9b14ff615bf2e3a8e2c9
SHA512

733a61c7caf053734cc8f946e0a7a00a0f146a79f42174bcd9395a98203689843b2c4c5dfebec069b1c2d45dd52c5677aab778c7abe54eeb3b34693fda17a244
SSDEEP

3072:IArM8kxxta3hqCdCd44E1f86LtaZ+waPszoX0vxIx+TlrGeoo3p4f+Xm0:2E6otaZ+w4s0X0mx+TlrGeoo3Kf+W0

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5012 wrote to memory of 2692	5012	rundll32.exe	rundll32.exe
PID 5012 wrote to memory of 2692	5012	rundll32.exe	rundll32.exe
PID 5012 wrote to memory of 2692	5012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt\labs\platform\qtlabsplatformplugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt\labs\platform\qtlabsplatformplugin.dll,#1
2⤵
PID:2692