0658cda97d6fc28bfe8be410cdd1a1900c3f5283ba0b746730d540370615c498 | Triage

Analysis

max time kernel
25s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 03:53

Sharing

Report Analysis Logs

General

Target

Qt5Concurrent.dll
Size

32KB
MD5

7e40b0faa08e8f2ad78be6698225e3e4
SHA1

03332c56e4dcfefc33bb731133bd3ef71c4ca9ec
SHA256

2212e66eadd559705e244409354ed264c286a3cac7a3e511737c3d31e2a0f4ae
SHA512

a4c545a8b8daaf6b4321bb51745454b77d1f591c7131f19fdd40bacd943d5074886037ceae19e7f1515313b0f990e42a83520957cedf056a39e1ec1e4afd7272
SSDEEP

768:zSv+K3b4/Cfg+E2wkjk/+ZW8DT92r+dDGMUf2hKd:Wvm6XS/8FDTsr+PUf/d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1964	1944	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1964	1944	rundll32.exe	28
PID 1944 wrote to memory of 1964	1944	rundll32.exe	28
PID 1944 wrote to memory of 1964	1944	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Concurrent.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1944 -s 216
  2⤵
  - Program crash
  PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads