659c54979fa4c75840e4ee9b17393be08dd86c5e7c726493b7eb58a8623bb6a7

Analysis

max time kernel
145s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
06/07/2024, 21:12

Target

QtQuick.2/qtquick2plugin.dll
Size

55KB
MD5

bc48935d7fb9d87eed3994024f1071f8
SHA1

9cea445364aae84a38d3e79b5aabdffd4229a284
SHA256

6fccb1c95c2198d15d818e640d7849af9215e741ebbaceecfee3f3315f90b0ae
SHA512

95dc78983ba867883766a3d2a988d56bd9c9a6252e8231e631a294c5a9cee3647862909f0282284d6c5d734d41685b8ca53823538bb23a7549098e5477676720
SSDEEP

768:7aaJIsYojnA4yZ5BmzDkbhsHGleu9VLDFI+9LgQgaONFemzHQ:7aagobA4yODCh4GleUD6wLgvaONFbLQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 2376	4216	rundll32.exe	78
PID 4216 wrote to memory of 2376	4216	rundll32.exe	78
PID 4216 wrote to memory of 2376	4216	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtQuick.2\qtquick2plugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtQuick.2\qtquick2plugin.dll,#1
  2⤵
  PID:2376