a1962d9109023ef685d8c52ef137a011965bbfa69ec72b44757d29cd9cbfbd24

Analysis

max time kernel
9s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28-12-2022 07:48

Target

UltimMC/Qt5Core.dll
Size

5.1MB
MD5

db2f4ec716747a5ddecb146cfd124a90
SHA1

dcc4e2efa1af32ed55c3b1d004eff6eaa2b6a02b
SHA256

ffed386cbbe2363331632d9f12be8eb00cf654d95b4c2b0d287da57e93813f80
SHA512

5db0356ff3dc3ef28e6a46dedb212c87ab791a61b8de682d0dbf22dda6630ca795e8aa89d4b8226f876440e47d5584e66dbeda481d8499c9f24f79506cf04005
SSDEEP

98304:paO5O7s0XerbbAJIaKSA31cCvErDsNYWZSgkvDFIJsv6tWKFdu9CQlld0:BOoZX8O1cBdUSg8DiJsv6tWKFdu9CQZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	1532	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 1532	1236	rundll32.exe	28
PID 1236 wrote to memory of 1532	1236	rundll32.exe	28
PID 1236 wrote to memory of 1532	1236	rundll32.exe	28
PID 1236 wrote to memory of 1532	1236	rundll32.exe	28
PID 1236 wrote to memory of 1532	1236	rundll32.exe	28
PID 1236 wrote to memory of 1532	1236	rundll32.exe	28
PID 1236 wrote to memory of 1532	1236	rundll32.exe	28
PID 1532 wrote to memory of 2044	1532	rundll32.exe	29
PID 1532 wrote to memory of 2044	1532	rundll32.exe	29
PID 1532 wrote to memory of 2044	1532	rundll32.exe	29
PID 1532 wrote to memory of 2044	1532	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\Qt5Core.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 264
    3⤵
    - Program crash
    PID:2044

memory/1532-55-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/1532-57-0x0000000068880000-0x0000000068DAF000-memory.dmp

Filesize
5.2MB

Download