707e4c6d5d57fe10d244fd24f57943ac4bd01f575cafa82dcacba9ce1ca6700e

Analysis

max time kernel
154s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 16:03

Target

NodeBeamEditor/bin/Qt5Core.dll
Size

4.6MB
MD5

87d6460772f138429cb8cc241b9db217
SHA1

724b9536224150a3f2c4ea512241602c8b6b34f1
SHA256

a7e2b3051de8e30993ed0f0fc6d6ef75c2d2e64c68bf499dc5bca2f008195ef8
SHA512

e006ec0c8ed3a7ff56f6bb8f682c9ad80c20dcc46fb5c9cb111abb0c728ec7e71f553a9a8c8aa84f6ad038e00e33e345dec7261761a2daa6d0852edc0159e258
SSDEEP

98304:2Y9qoTEpnpZrYfDzSQorYbs3AtLu9ZYF7Cn3L3K7F96CoqmNSJsv6tWKFdu9C1c:NIpnvsfyQolkuvYle36oqmNSJsv6tWK0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3256	3984	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3984	3908	rundll32.exe	84
PID 3908 wrote to memory of 3984	3908	rundll32.exe	84
PID 3908 wrote to memory of 3984	3908	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NodeBeamEditor\bin\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\NodeBeamEditor\bin\Qt5Core.dll,#1
  2⤵
  PID:3984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 700
    3⤵
    - Program crash
    PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3984 -ip 3984
1⤵
PID:380

memory/3984-133-0x0000000068880000-0x0000000068D26000-memory.dmp

Filesize
4.6MB

Download
memory/3984-134-0x000000006E940000-0x000000006E964000-memory.dmp

Filesize
144KB

Download
memory/3984-136-0x000000006FC40000-0x000000006FD41000-memory.dmp

Filesize
1.0MB

Download
memory/3984-135-0x0000000064940000-0x0000000064954000-memory.dmp

Filesize
80KB

Download
memory/3984-137-0x0000000061A40000-0x0000000061CED000-memory.dmp

Filesize
2.7MB

Download
memory/3984-138-0x0000000068F80000-0x0000000069133000-memory.dmp

Filesize
1.7MB

Download
memory/3984-139-0x0000000066500000-0x0000000067999000-memory.dmp

Filesize
20.6MB

Download