f62712e793e7109552e2cb9c1a57c269be95eb4be1226c5d5ea481229d513ebb

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 10:33

Target

$PLUGINSDIR/Qt5Gui.dll
Size

5.1MB
MD5

9af8844d2e5fa1b78ca5d5717750bf8e
SHA1

69768b6a935ad6aacf07576a3a34bb84464953f2
SHA256

7923ffadf87460d0ec4bfb55c1440657128d983d3f8b0577fb4eda5d504db1c6
SHA512

b2141fed59308a8ae46e0b820ce14a591777fc84a6dbbfd908f34445a1d34b62e3cb4c0ee1dfd500d18bd490337be84830926cd4a8a78959b5186a2703d942d2
SSDEEP

49152:vwKenbQk8Z4pDLH2Q47hIZSwlk10Sa1MGtsb7tefi2qF5b+Q9azN3plyayI:oG4pqVIxS+9cSplP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2084 wrote to memory of 2952	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2952	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2952	2084	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Qt5Gui.dll,#1
2⤵
PID:2952