44ecc6a7624b2fdf03cb9b419f111892515fb036fe23f88e51456dce69066046

Analysis

max time kernel
446s
max time network
458s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
24/06/2024, 11:03

Target

QtQuick/Controls.2/Fusion/qtquickcontrols2fusionstyleplugin.dll
Size

586KB
MD5

30d46b7307bfff330ecbb390fa3b5b50
SHA1

eb91db0e36c0cdf7c6eac2fe59b23eb7bf3d2520
SHA256

7f674fc7d2b61dbfa632036e811fbf5e46f49d8fa1f35341f6faafd1a9810fc3
SHA512

0237794607d11182c34449c4cb8d8e45c033d6d9c41e9c77b825394e8ef38f93ca8ee97d0c518572010c8439f74081445caad22c7fa6c7a671bb2fc6727df3ce
SSDEEP

12288:ivJA/upprpp9pp1ppeppMppnppcppdpp3p3uppOppIppCppPpp6ppvppKppsppnv:ivJqg

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 1276	4188	rundll32.exe	76
PID 4188 wrote to memory of 1276	4188	rundll32.exe	76
PID 4188 wrote to memory of 1276	4188	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtQuick\Controls.2\Fusion\qtquickcontrols2fusionstyleplugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtQuick\Controls.2\Fusion\qtquickcontrols2fusionstyleplugin.dll,#1
  2⤵
  PID:1276