0658cda97d6fc28bfe8be410cdd1a1900c3f5283ba0b746730d540370615c498

Analysis

max time kernel
25s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/04/2023, 03:53

Target

Qt5Multimedia.dll
Size

728KB
MD5

01df79071f9da0b9b7bda3db7fdc8809
SHA1

6944acc06f8691a27aa0833d29f0389f0e036bf0
SHA256

1a59ae2a9ff768ad6bfb888fe3dd2544e238f0b28da83cf375ebd803ce713dc4
SHA512

486d3f93e56ab50e0c9937e3472762946afdbb28279818d42081f5784f3af2df6d55253d4cf4839601058dcefb5e543144b91b4572bed96ca9926a0a2afe5711
SSDEEP

6144:jLIJMPFfMerCs1uXdHbbbboLxywnY9jnvQz5dm9mMhI/p5PQCf3FR19EjqD0jKds:j+MPFfMervUXzYeg/mR4G

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	1544	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 1608	1544	rundll32.exe	28
PID 1544 wrote to memory of 1608	1544	rundll32.exe	28
PID 1544 wrote to memory of 1608	1544	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Multimedia.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1544 -s 232
  2⤵
  - Program crash
  PID:1608