b64924f4c7a82865535fc4c4f7636d7b03b73d01a29330efc030d878c07e88e1

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 14:43

Target

K Series Log Viewer/Qt5Widgets.dll
Size

4.3MB
MD5

fe4e5ed83642e0dd84bb41450d020af6
SHA1

275601e50eecb6c7e19d9dd4ddbe6e23faa92650
SHA256

baa679fbb6b375ea4f9a2c536e8cc750cdf25946379dced876d2a855ddaa838c
SHA512

b29e60ff24684a969b61357aadc3d8a5614521cc77fe52016f886fd8b40f13f2b8f8b34cd9888d3c972642a06a6b94c29a193d7ab09a8285277f414df96f5d18
SSDEEP

49152:LNYrZPyqlHjgvBDFx+jnn1nSQnCKWnDcxcYd/IAm4:ClqDFx+YxK7mY9IAm4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	3016	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 3016	884	rundll32.exe	28
PID 884 wrote to memory of 3016	884	rundll32.exe	28
PID 884 wrote to memory of 3016	884	rundll32.exe	28
PID 884 wrote to memory of 3016	884	rundll32.exe	28
PID 884 wrote to memory of 3016	884	rundll32.exe	28
PID 884 wrote to memory of 3016	884	rundll32.exe	28
PID 884 wrote to memory of 3016	884	rundll32.exe	28
PID 3016 wrote to memory of 2216	3016	rundll32.exe	29
PID 3016 wrote to memory of 2216	3016	rundll32.exe	29
PID 3016 wrote to memory of 2216	3016	rundll32.exe	29
PID 3016 wrote to memory of 2216	3016	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\K Series Log Viewer\Qt5Widgets.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\K Series Log Viewer\Qt5Widgets.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 260
    3⤵
    - Program crash
    PID:2216