ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55 | Triage

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 18:09

Sharing

Report Analysis Logs

General

Target

archive/appsremote/qgif.dll
Size

32KB
MD5

c108d79d7c85786f33f85041445f519f
SHA1

2c30d1afc274315c6d50ee19a47fff74a8937ea1
SHA256

d5459a707922dd2bf50114cc6718965173ee5b0f67deb05e933556150cfdd9d1
SHA512

6bb5316cd8cd193a8bc2b9fbe258a4b9233508f4aaaa079d930a8c574dc9c9786863ae0a181061fcb2a84b7a43e5b98c5a264cad8aae5e0890a2a58c114a0d9c
SSDEEP

768:6EIE7zOufzpO8hY7OvWlMwQLFUchQtOqzy3:sEfOu1OCoOvWlRQRUch+/y

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 4728	344	rundll32.exe	84
PID 344 wrote to memory of 4728	344	rundll32.exe	84
PID 344 wrote to memory of 4728	344	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qgif.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qgif.dll,#1
  2⤵
  PID:4728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads