44ecc6a7624b2fdf03cb9b419f111892515fb036fe23f88e51456dce69066046

Analysis

max time kernel
445s
max time network
455s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
24-06-2024 11:03

Target

QtQuick/Controls.2/Imagine/qtquickcontrols2imaginestyleplugin.dll
Size

1.5MB
MD5

5282cd3eef6f9fbda9a4b43b13738f2d
SHA1

3a50f66b153855822c41af99941162098cedda80
SHA256

a08c3b02dd24c99208d8be394c56a9953d0558d4fa9336b784454ef990e5c777
SHA512

e81fb261dc1e0ed099565731f1ebd5c0072b5bbe634e3b905e80689fcae5dc377f30915bc422326eef2d2319ed7776d3f9f1c36e57db7369165391fb8cb8425f
SSDEEP

24576:i2IFT4juIEp1mogpOzH/r1K5JXN/tpyUnJV8DX:u3ICmogeHTcHXltpyUnv8r

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1708	2380	rundll32.exe	80
PID 2380 wrote to memory of 1708	2380	rundll32.exe	80
PID 2380 wrote to memory of 1708	2380	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtQuick\Controls.2\Imagine\qtquickcontrols2imaginestyleplugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtQuick\Controls.2\Imagine\qtquickcontrols2imaginestyleplugin.dll,#1
  2⤵
  PID:1708