707e4c6d5d57fe10d244fd24f57943ac4bd01f575cafa82dcacba9ce1ca6700e

Analysis

max time kernel
149s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/05/2023, 16:03

Target

NodeBeamEditor/bin/Qt5Core.dll
Size

4.6MB
MD5

87d6460772f138429cb8cc241b9db217
SHA1

724b9536224150a3f2c4ea512241602c8b6b34f1
SHA256

a7e2b3051de8e30993ed0f0fc6d6ef75c2d2e64c68bf499dc5bca2f008195ef8
SHA512

e006ec0c8ed3a7ff56f6bb8f682c9ad80c20dcc46fb5c9cb111abb0c728ec7e71f553a9a8c8aa84f6ad038e00e33e345dec7261761a2daa6d0852edc0159e258
SSDEEP

98304:2Y9qoTEpnpZrYfDzSQorYbs3AtLu9ZYF7Cn3L3K7F96CoqmNSJsv6tWKFdu9C1c:NIpnvsfyQolkuvYle36oqmNSJsv6tWK0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1248	1640	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1640	1264	rundll32.exe	27
PID 1264 wrote to memory of 1640	1264	rundll32.exe	27
PID 1264 wrote to memory of 1640	1264	rundll32.exe	27
PID 1264 wrote to memory of 1640	1264	rundll32.exe	27
PID 1264 wrote to memory of 1640	1264	rundll32.exe	27
PID 1264 wrote to memory of 1640	1264	rundll32.exe	27
PID 1264 wrote to memory of 1640	1264	rundll32.exe	27
PID 1640 wrote to memory of 1248	1640	rundll32.exe	28
PID 1640 wrote to memory of 1248	1640	rundll32.exe	28
PID 1640 wrote to memory of 1248	1640	rundll32.exe	28
PID 1640 wrote to memory of 1248	1640	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NodeBeamEditor\bin\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NodeBeamEditor\bin\Qt5Core.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 264
    3⤵
    - Program crash
    PID:1248

memory/1640-55-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/1640-56-0x0000000064940000-0x0000000064954000-memory.dmp

Filesize
80KB

Download
memory/1640-54-0x0000000068880000-0x0000000068D26000-memory.dmp

Filesize
4.6MB

Download
memory/1640-57-0x000000006FC40000-0x000000006FD41000-memory.dmp

Filesize
1.0MB

Download
memory/1640-58-0x0000000061A40000-0x0000000061CED000-memory.dmp

Filesize
2.7MB

Download
memory/1640-59-0x0000000068F80000-0x0000000069133000-memory.dmp

Filesize
1.7MB

Download
memory/1640-60-0x0000000066500000-0x0000000067999000-memory.dmp

Filesize
20.6MB

Download