ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 18:09

Target

archive/appsremote/qtga.dll
Size

25KB
MD5

d0604a5f13b32a08d5fa5bd887f869a6
SHA1

976338eb697507ac857a6434ef1086f34bc9db24
SHA256

2b6444d2a8146a066109ca19618ceee98444127a5b422c14635ab837887e55bf
SHA512

c42edbaf6506dc1ca3aae3f052a07c7d2c4841f5b83003186cda185193f7cd2035cfe07e04a28356d254ab54666b5d60be4763e3e204273ecd0d7f2cd84bfc90
SSDEEP

384:fFMPiwwZFypMrcrQVdPy82S8fQ4rI95QLjPx6/kOk0GfZQ5g+zCxw:CKwwZFypFrQVdPy4zQSQL7x68OqQyG

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 636	3196	rundll32.exe	84
PID 3196 wrote to memory of 636	3196	rundll32.exe	84
PID 3196 wrote to memory of 636	3196	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qtga.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qtga.dll,#1
  2⤵
  PID:636