ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55 | Triage

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 18:09

Sharing

Report Analysis Logs

General

Target

archive/appsremote/qico.dll
Size

32KB
MD5

eddf7fb99f2fcaea6fe4fd34b8fd5d39
SHA1

85bbc7a2e1aaafd043e6c69972125202be21c043
SHA256

9d942215a80a25e10ee1a2bb3d7c76003642d3a2d704c38c822e6a2ca82227bf
SHA512

0b835d4521421d305cf34d16b521f0c49b37812ef54a20b4ab69998b032cca59581b35c01e885ec4a77eac0b4e1d23228d9c76186a04a346a83f74a7198c343b
SSDEEP

768:/F7ME5fbPFzbvG+pnu8dZ8E28M2UQ1gLWmFOq+yQH:/eYbPFG4nuKmE/HUAg6mF/m

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2684	2316	rundll32.exe	30
PID 2316 wrote to memory of 2684	2316	rundll32.exe	30
PID 2316 wrote to memory of 2684	2316	rundll32.exe	30
PID 2316 wrote to memory of 2684	2316	rundll32.exe	30
PID 2316 wrote to memory of 2684	2316	rundll32.exe	30
PID 2316 wrote to memory of 2684	2316	rundll32.exe	30
PID 2316 wrote to memory of 2684	2316	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qico.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qico.dll,#1
  2⤵
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads