0658cda97d6fc28bfe8be410cdd1a1900c3f5283ba0b746730d540370615c498 | Triage

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 03:53

Sharing

Report Analysis Logs

General

Target

Qt5Svg.dll
Size

322KB
MD5

03761f923e52a7269a6e3a7452f6be93
SHA1

2ce53c424336bcc8047e10fa79ce9bce14059c50
SHA256

7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
SHA512

de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
SSDEEP

6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	1220	WerFault.exe	10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1728	1220	rundll32.exe	28
PID 1220 wrote to memory of 1728	1220	rundll32.exe	28
PID 1220 wrote to memory of 1728	1220	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Svg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1220 -s 220
  2⤵
  - Program crash
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-54-0x000007FEF5E10000-0x000007FEF6351000-memory.dmp

Filesize
5.3MB

Download