ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:30

Target
archive/appsremote/qicns.dll
Size 38KB
Sample240711-ppgp8syepa
SHA256 e665f3519309bae42e0e62f459ecc511701ddddf94599ebfd213d0a71775c462
MD5 52c6978203ca20beead6e8872e80d39f
SHA1 f223b7ba12657cd68da60ab14f7ab4a2803fc6e7
SHA512 88b64203d6f3daed11da153bc2f02196296203dc913836c98595c09f7772c40830284366db964fcb6886b78b0ebb8f78517cdc7b6d0ad7922861597eaf474b85
SSDEEP 768:CIz31g+6jT06+WEFnZqGVPJWJzvincpC9qcF6xsb0yJsYUOq/yRk:VJg+6jT06+WEFRxJWJzvscIrF6abvJsx
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1708	2204	rundll32.exe	30
PID 2204 wrote to memory of 1708	2204	rundll32.exe	30
PID 2204 wrote to memory of 1708	2204	rundll32.exe	30
PID 2204 wrote to memory of 1708	2204	rundll32.exe	30
PID 2204 wrote to memory of 1708	2204	rundll32.exe	30
PID 2204 wrote to memory of 1708	2204	rundll32.exe	30
PID 2204 wrote to memory of 1708	2204	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qicns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qicns.dll,#1
  2⤵
  PID:1708