ebb59161759ac7e1a5c5b58f4eac53013778d1d39a5be4979c099a80c7f0bc55

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 18:09

Target

archive/appsremote/qicns.dll
Size

38KB
MD5

52c6978203ca20beead6e8872e80d39f
SHA1

f223b7ba12657cd68da60ab14f7ab4a2803fc6e7
SHA256

e665f3519309bae42e0e62f459ecc511701ddddf94599ebfd213d0a71775c462
SHA512

88b64203d6f3daed11da153bc2f02196296203dc913836c98595c09f7772c40830284366db964fcb6886b78b0ebb8f78517cdc7b6d0ad7922861597eaf474b85
SSDEEP

768:CIz31g+6jT06+WEFnZqGVPJWJzvincpC9qcF6xsb0yJsYUOq/yRk:VJg+6jT06+WEFRxJWJzvscIrF6abvJsx

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30
PID 2708 wrote to memory of 2176	2708	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qicns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\archive\appsremote\qicns.dll,#1
  2⤵
  PID:2176