77763018072adb9e864f06deac9ae588a7ec4ea1a112f9f82c6201d5b7973e84 | Triage

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 08:30

Sharing

Report Analysis Logs

General

Target

imageformats/qgif4.dll
Size

24KB
MD5

8888ac64b14be01cf9a3c57d85c2f654
SHA1

445d7b9d78b68b96fb61c2df8582d175a7f9bcc2
SHA256

2972ab6f8d716fe05383d60f50508effdcd918cdb2b1f714fff84bd88888a10c
SHA512

81c1f6a075097cb6c8fa9675c15994cffe3aa90a82b1bbe873e6897ca417644734a1d254714e828814174ad459b7d246339fe86f42b14b21d70b191e40ab67f4
SSDEEP

768:mtx5hoOyG83CUOwkq+71WJSgSnqaOyUsgr:yovtCUPkq+7A8RnqaOy9g

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 3420	2420	rundll32.exe	91
PID 2420 wrote to memory of 3420	2420	rundll32.exe	91
PID 2420 wrote to memory of 3420	2420	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\imageformats\qgif4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\imageformats\qgif4.dll,#1
  2⤵
  PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4544,i,8660989700097327804,17931739887231169645,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
1⤵
PID:4460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads