0658cda97d6fc28bfe8be410cdd1a1900c3f5283ba0b746730d540370615c498 | Triage

Analysis

max time kernel
21s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 03:53

Sharing

Report Analysis Logs

General

Target

Qt5WinExtras.dll
Size

231KB
MD5

c842e53c70d966569f1c15cee142a813
SHA1

33e88b286374dbe49e77988c1e30d78f8dccd88e
SHA256

9987b4bff62ef5c0c75dfcdbe50b1d02d0ae38a8123a816fbe4326ea8538069a
SHA512

062897dd47312dc6886db9c5a4c948c42608f9ede6d9863cf0445c5ab3c87c8c6f1ff8ca6168e73c1e29f3f512a42d31886a07abca7e2ddbb059072317e975bf
SSDEEP

3072:+cCV8FbUC+djfYwkPD1LTrUvrz+jUHURnDSRU5:34QZL0vrajUHURnDSe5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	1980	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1964	1980	rundll32.exe	27
PID 1980 wrote to memory of 1964	1980	rundll32.exe	27
PID 1980 wrote to memory of 1964	1980	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5WinExtras.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1980 -s 220
  2⤵
  - Program crash
  PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads