b61fed559224dec5c55d61b344407e65bb7253586120f144a8f07db35a41383d

Analysis

max time kernel
452s
max time network
458s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
01-07-2024 19:07

Target

bearer/qgenericbearer.dll
Size

45KB
MD5

dba35d31c2b6797c8a4d38ae27d68e6e
SHA1

37948e71dc758964e0aa19aee063b50ef87a7290
SHA256

086d6ba24f34a269856c4e0159a860657590d05aabb2530247e685543b34c52f
SHA512

282e7613fe445785fa5ed345415bc008637b7d1d7988cc6da715b024311a1c29425f5edb26a1d90f301af408b60244dd81e1459eef2aab10b07d1ac352770b4b
SSDEEP

768:B+B5mIpDC6s1Hf30HdG806zHgaEsyJa5gYnDGMHgtpQu8KOqfyc:UB5mTfEHdh0GHga9nDGigvQu8K/J

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3904 wrote to memory of 3368	3904	rundll32.exe	rundll32.exe
PID 3904 wrote to memory of 3368	3904	rundll32.exe	rundll32.exe
PID 3904 wrote to memory of 3368	3904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bearer\qgenericbearer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bearer\qgenericbearer.dll,#1
2⤵
PID:3368