31e8dda13e7a2e04829a653f8d30ddea96763b4045c6f9123160539cbf7b1e14

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 11:34

Target

$SYSDIR/Qt5QmlWorkerScript.dll
Size

47KB
MD5

52aa72cc6dbd67f5f203afd72ba0df92
SHA1

a52ebb259b3e1d1f9dbd9c359e0bceb469c3b8a4
SHA256

42faea919d50c5112c6a24e2e40feee6eaabb08dfd1330bb8b91fa249fb8b2be
SHA512

31a01095fa9c8bc4b420c1463e77fcea732637924c74662c0506aa13551d7e267fc7d2a99189b354aa2077bbb7a4f94322ea686031377825dc69476189c472fa
SSDEEP

768:NKNxAextI4fEp+7vSOKjBo5XqT1nsR13uT2B+0dDGgyUf2hT:NGDTINpiXOB0qT1nsR1eT2B+0NyUfu

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2344 wrote to memory of 2952	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2952	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2952	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2952	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2952	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2952	2344	rundll32.exe	rundll32.exe
PID 2344 wrote to memory of 2952	2344	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5QmlWorkerScript.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5QmlWorkerScript.dll,#1
2⤵
PID:2952