80abc14026ede9a9d0b601f925dfed172e6443eb20c63786866760395b1cb79b

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 17:01

Target

QtCore4.dll
Size

3.3MB
MD5

b53c9659db9e04c43b11243fd592af7b
SHA1

3fba2aa2d8c989344d78238aaea5c0f8ed692a1f
SHA256

a481f8e5ffd822be4949564b834414cd25dc85c3822bc48881471ca4ebed6b91
SHA512

1fe1b126d43a2b5d3ea6843d0ef3672979e8d07f0b02e77fb38d5892b50b2e7947798ffd53e9f3273eebaa6a53a7f411f88703331b20226eabca6694df4e2d9c
SSDEEP

49152:ecwQ1/5MJJA7Lj/xgLIU+l9Q8kGNu6O1f7uh1Jsv6tWKFdu9ClLyvL/6mShMZtmI:ecwTzMl9QsG6Jsv6tWKFdu9CtZlbC

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1904	2036	rundll32.exe	28
PID 2036 wrote to memory of 1904	2036	rundll32.exe	28
PID 2036 wrote to memory of 1904	2036	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtCore4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2036 -s 136
  2⤵
  PID:1904

memory/2036-0-0x000000006E0C0000-0x000000006E41A000-memory.dmp

Filesize
3.4MB

Download
memory/2036-2-0x0000000063180000-0x000000006319C000-memory.dmp

Filesize
112KB

Download
memory/2036-3-0x000000006A5C0000-0x000000006A6FC000-memory.dmp

Filesize
1.2MB

Download
memory/2036-4-0x0000000062E80000-0x0000000062EB5000-memory.dmp

Filesize
212KB

Download