f62712e793e7109552e2cb9c1a57c269be95eb4be1226c5d5ea481229d513ebb

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 10:33

Target

$PLUGINSDIR/imageformats/qsvg.dll
Size

26KB
MD5

ca2ea003c6fb8ee2b3f059dcd9338012
SHA1

7ad2a5bdba61f432d5a5cc655d6834a91e6fc2f3
SHA256

87905c987b8e6301d50ff691482c6cc262d0c96973a38e2d8a294cd720b37b4d
SHA512

6cc54d7e8308ddd5ed2c4eef113bacf87425e8cf6143466614549e25431b880eed663afae671eefa21eec2ef78635dd64e57df971bcaebf8ae33752815bcf249
SSDEEP

384:Sf3PFJXVOU5YI2mugHc+jLHJMnZIJwMpCIWg9XCNrxibiqoOH+E/jT5dnfePPLTP:uFJmI2J+jLH6ZguIjIYb6OeYjTfmzh5

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3192 wrote to memory of 3008	3192	rundll32.exe	rundll32.exe
PID 3192 wrote to memory of 3008	3192	rundll32.exe	rundll32.exe
PID 3192 wrote to memory of 3008	3192	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\imageformats\qsvg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3192

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\imageformats\qsvg.dll,#1
2⤵
PID:3008