e04d1e223f771a9d89e675815914be8dbf70343c6679f5602469698f44779b03

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 18:32

Target

QtCore4.dll
Size

2.5MB
MD5

20a6fa8231e1e064e4b4227e936b47ab
SHA1

4a1d7f735a267f66c1616ba6c1b0ec99581326aa
SHA256

e1fd09071363edec08c375b0b1ff89beac62be9270a3033cb8f8d4cce48af118
SHA512

0701c2dfe95ccda78bb97010dced5d1a0a3ee95c9e4a66e1c9cb2c370677d986f8467840a552f24ae7c105b39f3d578100db0fe70f53d4d35864984840d35d64
SSDEEP

49152:tgJEfNWNh7Y1/p3mQcPHF/YI+gYKa7fjU/DHLuoTlaCZAgXPNhppA12faL0EEOhO:tgJEfah7Y1/p3mQcPHF/YI+gYKa7fjUv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1160	3424	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3424	1148	rundll32.exe	87
PID 1148 wrote to memory of 3424	1148	rundll32.exe	87
PID 1148 wrote to memory of 3424	1148	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtCore4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtCore4.dll,#1
  2⤵
  PID:3424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 648
    3⤵
    - Program crash
    PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3424 -ip 3424
1⤵
PID:2228

memory/3424-0-0x000000006A1C0000-0x000000006A453000-memory.dmp

Filesize
2.6MB

Download
memory/3424-1-0x000000006FBC0000-0x000000006FBC8000-memory.dmp

Filesize
32KB

Download