659c54979fa4c75840e4ee9b17393be08dd86c5e7c726493b7eb58a8623bb6a7

Analysis

max time kernel
150s
max time network
160s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
06-07-2024 21:12

Target

QtQuick/Controls.2/Fusion/qtquickcontrols2fusionstyleplugin.dll
Size

737KB
MD5

dc4a14295bb1ff490290a2c97ef6b887
SHA1

465157b5021923855234816b4243e6f8597e35fd
SHA256

80c6eb72431dd51f6f9822aa8ae7dfddb633092b623e34643f9e99242d591b22
SHA512

71d0d4fa958e69351af72b0eb0842befbad599bf2f2398f7401b2f808530a76f8b685dade3f806ab53798eed715e8bc11860b26a8d389a3b37ceefd1dcfd4627
SSDEEP

12288:qYJiupprpp9pp1ppeppMppnppcppdpp3p3uppOppIppCppPpp6ppvppKppsppnp0:Lgw6

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 4264	1648	rundll32.exe	81
PID 1648 wrote to memory of 4264	1648	rundll32.exe	81
PID 1648 wrote to memory of 4264	1648	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtQuick\Controls.2\Fusion\qtquickcontrols2fusionstyleplugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtQuick\Controls.2\Fusion\qtquickcontrols2fusionstyleplugin.dll,#1
  2⤵
  PID:4264