1b3f39e0d2c736b7dbbc037931820f690698b2d4caa903abd49a8104375f0def | Triage

Analysis

max time kernel
64s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 07:40

Sharing

Report Analysis Logs

General

Target

1/Qt5Gui.dll
Size

310KB
MD5

0b9fcfbd6d44e4d83605cc35171668c8
SHA1

f4013116d6750829851370ed19a9eaf8251ad6e1
SHA256

ebdcedbc3e24b911aacd7bb666ab426397ca7d7883a8d4e3cf28946041c95425
SHA512

e920e284f47f888d10cac45ec8775e58481f5a8c2316d3fa01ff1e7b1bb63c64d2d0850b2da8fd040727b969d3b3f9b85afbd86b6cbfaecca580b853a1499f59
SSDEEP

3072:Jy6nSomUPQukwpSor62AIiGYIR2LGPHc0Ul+S4KQdw6tqYKVFlCh7NZqSEgbh:JciFkwpL2DI0yPHTw6tVKYr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2000 1712 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1712 wrote to memory of 2000	1712	rundll32.exe	WerFault.exe
PID 1712 wrote to memory of 2000	1712	rundll32.exe	WerFault.exe
PID 1712 wrote to memory of 2000	1712	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1712 -s 160
  2⤵
  - Program crash
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads