16516e594a36703457c3052e83d1dfbdfccfdf7c2a4712cb77de322c22df3d31 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 17:35

Sharing

Report Analysis Logs

General

Target

win_qqsq/iext.dll
Size

216KB
MD5

cba933625bfa502fc4a1d9f34e1e4473
SHA1

5319194388c0e53321f99f1541b97af191999a09
SHA256

25549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013
SHA512

f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142
SSDEEP

3072:1dh+NmslaQ7iAvBvXo8M360VVQrtPdDMDyowHhRJl5pnR:iiGK8M36zVdRL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2212	2308	rundll32.exe	31
PID 2308 wrote to memory of 2212	2308	rundll32.exe	31
PID 2308 wrote to memory of 2212	2308	rundll32.exe	31
PID 2308 wrote to memory of 2212	2308	rundll32.exe	31
PID 2308 wrote to memory of 2212	2308	rundll32.exe	31
PID 2308 wrote to memory of 2212	2308	rundll32.exe	31
PID 2308 wrote to memory of 2212	2308	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\win_qqsq\iext.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\win_qqsq\iext.dll,#1
  2⤵
  PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads