31e8dda13e7a2e04829a653f8d30ddea96763b4045c6f9123160539cbf7b1e14

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 11:34

Target

$SYSDIR/Qt5SerialPort.dll
Size

64KB
MD5

76d5e06e7cd3dda770e73b311d908334
SHA1

01fb750d2a7dc02baa8dc5189354325a9d17c131
SHA256

de57f02ab8dee19889a13be9976e90ce0aa2f1b7db2e09d3608b465faabed167
SHA512

547f550759caab21473d5e239629e00542094e3214c7a05ae5883071129670ce5535b35c81e9045dea72db8bbbb6fa3953039b3daaee4f2f922a68e3f7b864ac
SSDEEP

768:tp8CUcv41KI1YRmTQTbjNuZOe/V9+A906sko7igZnU0Vkh2lWkPiyk38h2psG/pH:Eyv4GR5DOy7iSf+hG1ZX7Wjl5VUUfaM

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1908 wrote to memory of 2908	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2908	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2908	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2908	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2908	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2908	1908	rundll32.exe	rundll32.exe
PID 1908 wrote to memory of 2908	1908	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5SerialPort.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5SerialPort.dll,#1
2⤵
PID:2908