ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55 | Triage

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 18:09

Sharing

Report Analysis Logs

General

Target

archive/appsremote/qico.dll
Size

32KB
MD5

eddf7fb99f2fcaea6fe4fd34b8fd5d39
SHA1

85bbc7a2e1aaafd043e6c69972125202be21c043
SHA256

9d942215a80a25e10ee1a2bb3d7c76003642d3a2d704c38c822e6a2ca82227bf
SHA512

0b835d4521421d305cf34d16b521f0c49b37812ef54a20b4ab69998b032cca59581b35c01e885ec4a77eac0b4e1d23228d9c76186a04a346a83f74a7198c343b
SSDEEP

768:/F7ME5fbPFzbvG+pnu8dZ8E28M2UQ1gLWmFOq+yQH:/eYbPFG4nuKmE/HUAg6mF/m

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 8	2684	rundll32.exe	84
PID 2684 wrote to memory of 8	2684	rundll32.exe	84
PID 2684 wrote to memory of 8	2684	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qico.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qico.dll,#1
  2⤵
  PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads