31e8dda13e7a2e04829a653f8d30ddea96763b4045c6f9123160539cbf7b1e14

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 11:34

Target

$SYSDIR/Qt5RemoteObjects.dll
Size

367KB
MD5

90440e9bb21020744d7ee012c85fc9c7
SHA1

18a53e46ccf66d06fa2c3988121df8ff3252a6a9
SHA256

618b020a57c4e3992119c839d66e64992201378b128b3778f43d864fa9c2adc4
SHA512

c06a98b597ca5111d390557e1cf38b0c52e4291422fa17a2b14cc5b333834d304c8be1b2a1485178a3821d3cfdbea3211266c283b9ee44bdd835966e9088ad70
SSDEEP

6144:0JwhxIO22VJwcSE997BX7PPcYvabtAl6FNJ8n0vxuOIbrz9sMOBETijLDYaGG4Jp:0JwHIO22DwcSE997BX7PPpvSvY0vxFId

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4588 wrote to memory of 3540	4588	rundll32.exe	rundll32.exe
PID 4588 wrote to memory of 3540	4588	rundll32.exe	rundll32.exe
PID 4588 wrote to memory of 3540	4588	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5RemoteObjects.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4588

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5RemoteObjects.dll,#1
2⤵
PID:3540