0658cda97d6fc28bfe8be410cdd1a1900c3f5283ba0b746730d540370615c498 | Triage

Analysis

max time kernel
23s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 03:53

Sharing

Report Analysis Logs

General

Target

Qt5Network.dll
Size

1.3MB
MD5

3569693d5bae82854de1d88f86c33184
SHA1

1a6084acfd2aa4d32cedfb7d9023f60eb14e1771
SHA256

4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
SHA512

e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32
SSDEEP

24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	1684	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1144	1684	rundll32.exe	27
PID 1684 wrote to memory of 1144	1684	rundll32.exe	27
PID 1684 wrote to memory of 1144	1684	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Network.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1684 -s 228
  2⤵
  - Program crash
  PID:1144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads