ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 18:09

Target

archive/appsremote/qdds.dll
Size

45KB
MD5

3fdb8d8407cccfaa0290036cc0107906
SHA1

fc708ecac271a35a0781fed826c11500184c1ea4
SHA256

3a71a119eeabce867b57636070adeb057443a6ec262be1360f344cb3905545db
SHA512

79fdf0f6316069a4810a67c64a662803dede86d32223b6c07da4e970d45e0a75f6027183a63d361787514fb095ce980a640c7e840c11aba93abc8318cc92ee94
SSDEEP

768:62cu2Izzl95wF36BhInlpnEIK3GeB7r3qgLgacVOqNRyU:40zl9u36BinbnEIK2eB7r6gUacV/R

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2056	2976	rundll32.exe	84
PID 2976 wrote to memory of 2056	2976	rundll32.exe	84
PID 2976 wrote to memory of 2056	2976	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qdds.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qdds.dll,#1
  2⤵
  PID:2056