5c28511a37fa39869f2d6fef6f8e9c8e282216823ec401803b649d9b79b84260

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 12:54

Target

QtNetwork4.dll
Size

983KB
MD5

2b653fea9a9d62172154174f2fa9a8e3
SHA1

1581935c56c29522c9d65b68bb0ccbaf2b2cda46
SHA256

105612c82d548d034f1478968fb50bfe2d52f338dd003d5b3d5ac12ab3f1622e
SHA512

5390697d4abdb3d82ca1175b51be11d1999e89bb090fb540236196c9839705cac151968be6194b6e13999734dfb2377b135d5704f28d48fb304c627045be2b04
SSDEEP

12288:Ej6ao6Js7aRcHhazfkYSgMa854EMeTElfSODH+YAJmBHPykUetXtMxW+mbxr8F:EWl6OPHMfkYSz54EkfbH+lkt9kq

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1096	2088	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2088	2808	rundll32.exe	28
PID 2808 wrote to memory of 2088	2808	rundll32.exe	28
PID 2808 wrote to memory of 2088	2808	rundll32.exe	28
PID 2808 wrote to memory of 2088	2808	rundll32.exe	28
PID 2808 wrote to memory of 2088	2808	rundll32.exe	28
PID 2808 wrote to memory of 2088	2808	rundll32.exe	28
PID 2808 wrote to memory of 2088	2808	rundll32.exe	28
PID 2088 wrote to memory of 1096	2088	rundll32.exe	29
PID 2088 wrote to memory of 1096	2088	rundll32.exe	29
PID 2088 wrote to memory of 1096	2088	rundll32.exe	29
PID 2088 wrote to memory of 1096	2088	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 240
    3⤵
    - Program crash
    PID:1096