0658cda97d6fc28bfe8be410cdd1a1900c3f5283ba0b746730d540370615c498

Analysis

max time kernel
28s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 03:53

Target

Qt5Widgets.dll
Size

5.2MB
MD5

4cd1f8fdcd617932db131c3688845ea8
SHA1

b090ed884b07d2d98747141aefd25590b8b254f9
SHA256

3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
SHA512

7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP

49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
828	1236	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 828	1236	rundll32.exe	28
PID 1236 wrote to memory of 828	1236	rundll32.exe	28
PID 1236 wrote to memory of 828	1236	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1236 -s 220
  2⤵
  - Program crash
  PID:828

memory/1236-54-0x000007FEF58F0000-0x000007FEF5E31000-memory.dmp

Filesize
5.3MB

Download