fda45010d8297cf7afd9ebb35510cf2628daf5fb247f7dad2c765e91674e2b52

Analysis

max time kernel
85s
max time network
32s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:39

Target

S3tupp__Pswrd--1231/dll/Qt5Gui.dll
Size

4.8MB
MD5

d9b78f4b2f8f393c8854c7cc95eae5d8
SHA1

8d648e7bda5b6bf7b02041189b9823fe8d4689e5
SHA256

55faebb8f5e28cde50f561bbd2638db7edcfd26e7ee7b975e0049b113145ae38
SHA512

6e76b524a56cc9bb5ae4beeedd41a48c35cf03c730752da3cae49862cb7bc3c17283099c39787f5933c1771eca7c2e651d92b961de7f43813f026eb295c90c81
SSDEEP

49152:PcLeg66Ry8jdAYbppzo7Tzj1/JrRbkwW6Ydzzr3YCWizxCqDRkU9i4g1/JAyn:kLrBpr1o7bRyfdzzxz0NTA4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2924	2652	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2652	1252	rundll32.exe	26
PID 1252 wrote to memory of 2652	1252	rundll32.exe	26
PID 1252 wrote to memory of 2652	1252	rundll32.exe	26
PID 1252 wrote to memory of 2652	1252	rundll32.exe	26
PID 1252 wrote to memory of 2652	1252	rundll32.exe	26
PID 1252 wrote to memory of 2652	1252	rundll32.exe	26
PID 1252 wrote to memory of 2652	1252	rundll32.exe	26
PID 2652 wrote to memory of 2924	2652	rundll32.exe	29
PID 2652 wrote to memory of 2924	2652	rundll32.exe	29
PID 2652 wrote to memory of 2924	2652	rundll32.exe	29
PID 2652 wrote to memory of 2924	2652	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\S3tupp__Pswrd--1231\dll\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\S3tupp__Pswrd--1231\dll\Qt5Gui.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 228
    3⤵
    - Program crash
    PID:2924