da3806880e342d4b826b9f58f55c1d75023ff5081c5373af911f21f45fd4b5f8

Analysis

max time kernel
135s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 21:13

Target

Qt5Network.dll
Size

2.5MB
MD5

2c96542971f03218a53b23355787dd37
SHA1

171771e55d8d23052d8f4a098915ffe4d6e86844
SHA256

6301e3fd9132ea79a7041b169ed1faea91100a48d049de610c1873214b214e27
SHA512

cc24956ebef0c179388f58ef736dcd9c621dd770360daaab52bcaa01db344491872aa0382adaa299877df2118006d1fe26f3fa1862527a1164b274ecd49a4c53
SSDEEP

49152:c4ITGhWXIXfbUuGEcpROd6ET2TE6Epc1JESlu143:c4ITGhWXmxGE4Od6ETSJP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4592	2488	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 2488	4328	rundll32.exe	82
PID 4328 wrote to memory of 2488	4328	rundll32.exe	82
PID 4328 wrote to memory of 2488	4328	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Network.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Network.dll,#1
  2⤵
  PID:2488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 724
    3⤵
    - Program crash
    PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2488 -ip 2488
1⤵
PID:1572

memory/2488-133-0x0000000069BC0000-0x0000000069EDD000-memory.dmp

Filesize
3.1MB

Download
memory/2488-134-0x000000006D400000-0x000000006D5BF000-memory.dmp

Filesize
1.7MB

Download
memory/2488-135-0x0000000063080000-0x000000006309E000-memory.dmp

Filesize
120KB

Download
memory/2488-136-0x000000006EB40000-0x000000006EB66000-memory.dmp

Filesize
152KB

Download
memory/2488-137-0x000000006FE40000-0x000000007001A000-memory.dmp

Filesize
1.9MB

Download
memory/2488-138-0x0000000064B40000-0x0000000064B5F000-memory.dmp

Filesize
124KB

Download
memory/2488-139-0x0000000066940000-0x0000000066EC2000-memory.dmp

Filesize
5.5MB

Download
memory/2488-141-0x0000000067C80000-0x0000000067CDC000-memory.dmp

Filesize
368KB

Download
memory/2488-140-0x0000000061840000-0x000000006185A000-memory.dmp

Filesize
104KB

Download
memory/2488-142-0x000000006CE80000-0x000000006D073000-memory.dmp

Filesize
1.9MB

Download
memory/2488-143-0x0000000069BC0000-0x0000000069EDD000-memory.dmp

Filesize
3.1MB

Download
memory/2488-144-0x0000000064F80000-0x000000006502D000-memory.dmp

Filesize
692KB

Download
memory/2488-145-0x0000000070740000-0x0000000072261000-memory.dmp

Filesize
27.1MB

Download