77763018072adb9e864f06deac9ae588a7ec4ea1a112f9f82c6201d5b7973e84 | Triage

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 08:30

Sharing

Report Analysis Logs

General

Target

imageformats/qgif4.dll
Size

24KB
MD5

8888ac64b14be01cf9a3c57d85c2f654
SHA1

445d7b9d78b68b96fb61c2df8582d175a7f9bcc2
SHA256

2972ab6f8d716fe05383d60f50508effdcd918cdb2b1f714fff84bd88888a10c
SHA512

81c1f6a075097cb6c8fa9675c15994cffe3aa90a82b1bbe873e6897ca417644734a1d254714e828814174ad459b7d246339fe86f42b14b21d70b191e40ab67f4
SSDEEP

768:mtx5hoOyG83CUOwkq+71WJSgSnqaOyUsgr:yovtCUPkq+7A8RnqaOy9g

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3020	2752	rundll32.exe	28
PID 2752 wrote to memory of 3020	2752	rundll32.exe	28
PID 2752 wrote to memory of 3020	2752	rundll32.exe	28
PID 2752 wrote to memory of 3020	2752	rundll32.exe	28
PID 2752 wrote to memory of 3020	2752	rundll32.exe	28
PID 2752 wrote to memory of 3020	2752	rundll32.exe	28
PID 2752 wrote to memory of 3020	2752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\imageformats\qgif4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\imageformats\qgif4.dll,#1
  2⤵
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads