da3806880e342d4b826b9f58f55c1d75023ff5081c5373af911f21f45fd4b5f8

Analysis

max time kernel
144s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/06/2023, 21:13

Target

Qt5Network.dll
Size

2.5MB
MD5

2c96542971f03218a53b23355787dd37
SHA1

171771e55d8d23052d8f4a098915ffe4d6e86844
SHA256

6301e3fd9132ea79a7041b169ed1faea91100a48d049de610c1873214b214e27
SHA512

cc24956ebef0c179388f58ef736dcd9c621dd770360daaab52bcaa01db344491872aa0382adaa299877df2118006d1fe26f3fa1862527a1164b274ecd49a4c53
SSDEEP

49152:c4ITGhWXIXfbUuGEcpROd6ET2TE6Epc1JESlu143:c4ITGhWXmxGE4Od6ETSJP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1740	2000	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2000	1988	rundll32.exe	28
PID 1988 wrote to memory of 2000	1988	rundll32.exe	28
PID 1988 wrote to memory of 2000	1988	rundll32.exe	28
PID 1988 wrote to memory of 2000	1988	rundll32.exe	28
PID 1988 wrote to memory of 2000	1988	rundll32.exe	28
PID 1988 wrote to memory of 2000	1988	rundll32.exe	28
PID 1988 wrote to memory of 2000	1988	rundll32.exe	28
PID 2000 wrote to memory of 1740	2000	rundll32.exe	29
PID 2000 wrote to memory of 1740	2000	rundll32.exe	29
PID 2000 wrote to memory of 1740	2000	rundll32.exe	29
PID 2000 wrote to memory of 1740	2000	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Network.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Network.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 280
    3⤵
    - Program crash
    PID:1740

memory/2000-54-0x0000000069BC0000-0x0000000069EDD000-memory.dmp

Filesize
3.1MB

Download
memory/2000-55-0x000000006D400000-0x000000006D5BF000-memory.dmp

Filesize
1.7MB

Download
memory/2000-56-0x0000000066940000-0x0000000066EC2000-memory.dmp

Filesize
5.5MB

Download
memory/2000-58-0x000000006EB40000-0x000000006EB66000-memory.dmp

Filesize
152KB

Download
memory/2000-59-0x000000006FE40000-0x000000007001A000-memory.dmp

Filesize
1.9MB

Download
memory/2000-57-0x0000000064B40000-0x0000000064B5F000-memory.dmp

Filesize
124KB

Download
memory/2000-60-0x0000000061840000-0x000000006185A000-memory.dmp

Filesize
104KB

Download
memory/2000-61-0x0000000069BC0000-0x0000000069EDD000-memory.dmp

Filesize
3.1MB

Download
memory/2000-62-0x000000006CE80000-0x000000006D073000-memory.dmp

Filesize
1.9MB

Download
memory/2000-63-0x0000000070740000-0x0000000072261000-memory.dmp

Filesize
27.1MB

Download
memory/2000-64-0x0000000067C80000-0x0000000067CDC000-memory.dmp

Filesize
368KB

Download
memory/2000-65-0x0000000063080000-0x000000006309E000-memory.dmp

Filesize
120KB

Download
memory/2000-66-0x0000000064F80000-0x000000006502D000-memory.dmp

Filesize
692KB

Download