dee2a766d38ca6a356dff7b80a926e35fd433f721edaf9201d386124ac5e043f

Resubmissions

03/08/2023, 21:16

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
03/08/2023, 21:16

Target

UltimMC/Qt5Network.dll
Size

2.7MB
MD5

ced4531f553504ed6770d999f9c82cb9
SHA1

3405a3118bb6479413b9a749ce4c0b395622883c
SHA256

77f1bd3192d9e8b15dd23adb15a3f83e92e9474df9a30450247fbe9e96b71736
SHA512

df98b27470b30377928bcea23e18b0c3d8e7929d0d7ee6862887440f6ef577e5172fcb02b82a20b4903ce9eb7e1d00cfb8e1785476cbaaee3da92354f701dcbc
SSDEEP

24576:oRCtw1I8cuk7uCFgYZO1sZqRBf5X7FDz8TZyGEsjrhdAdu6m3BZ0526tcxYiohN4:h8cukSZFDz8Zj1n073NTuRyIOpunDb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1856	1612	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 1612	3848	rundll32.exe	85
PID 3848 wrote to memory of 1612	3848	rundll32.exe	85
PID 3848 wrote to memory of 1612	3848	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\Qt5Network.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\UltimMC\Qt5Network.dll,#1
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 724
    3⤵
    - Program crash
    PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1612 -ip 1612
1⤵
PID:4044

memory/1612-133-0x0000000068A80000-0x000000006911A000-memory.dmp

Filesize
6.6MB

Download
memory/1612-134-0x0000000069900000-0x0000000069AE2000-memory.dmp

Filesize
1.9MB

Download
memory/1612-136-0x000000006EB40000-0x000000006EB63000-memory.dmp

Filesize
140KB

Download
memory/1612-137-0x0000000064B40000-0x0000000064B54000-memory.dmp

Filesize
80KB

Download
memory/1612-138-0x000000006FE40000-0x000000006FFC3000-memory.dmp

Filesize
1.5MB

Download