ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 18:09

Target

archive/appsremote/qgenericbearer.dll
Size

45KB
MD5

dba35d31c2b6797c8a4d38ae27d68e6e
SHA1

37948e71dc758964e0aa19aee063b50ef87a7290
SHA256

086d6ba24f34a269856c4e0159a860657590d05aabb2530247e685543b34c52f
SHA512

282e7613fe445785fa5ed345415bc008637b7d1d7988cc6da715b024311a1c29425f5edb26a1d90f301af408b60244dd81e1459eef2aab10b07d1ac352770b4b
SSDEEP

768:B+B5mIpDC6s1Hf30HdG806zHgaEsyJa5gYnDGMHgtpQu8KOqfyc:UB5mTfEHdh0GHga9nDGigvQu8K/J

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2244	772	rundll32.exe	31
PID 772 wrote to memory of 2244	772	rundll32.exe	31
PID 772 wrote to memory of 2244	772	rundll32.exe	31
PID 772 wrote to memory of 2244	772	rundll32.exe	31
PID 772 wrote to memory of 2244	772	rundll32.exe	31
PID 772 wrote to memory of 2244	772	rundll32.exe	31
PID 772 wrote to memory of 2244	772	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qgenericbearer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qgenericbearer.dll,#1
  2⤵
  PID:2244