ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55

Analysis

max time kernel
11s
max time network
19s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:30

Target
archive/appsremote/qdds.dll
Size 45KB
Sample240711-ppgp8syepa
SHA256 3a71a119eeabce867b57636070adeb057443a6ec262be1360f344cb3905545db
MD5 3fdb8d8407cccfaa0290036cc0107906
SHA1 fc708ecac271a35a0781fed826c11500184c1ea4
SHA512 79fdf0f6316069a4810a67c64a662803dede86d32223b6c07da4e970d45e0a75f6027183a63d361787514fb095ce980a640c7e840c11aba93abc8318cc92ee94
SSDEEP 768:62cu2Izzl95wF36BhInlpnEIK3GeB7r3qgLgacVOqNRyU:40zl9u36BinbnEIK2eB7r6gUacV/R
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 3000	112	rundll32.exe	30
PID 112 wrote to memory of 3000	112	rundll32.exe	30
PID 112 wrote to memory of 3000	112	rundll32.exe	30
PID 112 wrote to memory of 3000	112	rundll32.exe	30
PID 112 wrote to memory of 3000	112	rundll32.exe	30
PID 112 wrote to memory of 3000	112	rundll32.exe	30
PID 112 wrote to memory of 3000	112	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qdds.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qdds.dll,#1
  2⤵
  PID:3000