f62712e793e7109552e2cb9c1a57c269be95eb4be1226c5d5ea481229d513ebb

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 10:33

Target

$PLUGINSDIR/imageformats/qjpeg.dll
Size

361KB
MD5

a411567f64e267460df090d795a8bb32
SHA1

f3762d6a199aac2824f418914069b5cff5914e05
SHA256

80e1b62b936b10cfae9610796b9e160615c0deffa82f0f8f27c2212baae9d7b8
SHA512

e123a351144f6ebcabaa89a7ee5c26b84b6938daa99a6e80e25cd2d65b955456d0cf7631f22ea3badbac21bcc58711e9588f3d4b4034305fe41faada318bf5c9
SSDEEP

6144:3R5dHv2EWf7gKRoRC01aGKJ91+sDJvlbt4HQHzzIfVuV1x3v8pmI1Hu:3RbifkQoRe91bNtbt4wTzIx1O

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3028 wrote to memory of 4240	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 4240	3028	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 4240	3028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\imageformats\qjpeg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\imageformats\qjpeg.dll,#1
2⤵
PID:4240