80abc14026ede9a9d0b601f925dfed172e6443eb20c63786866760395b1cb79b

Analysis

max time kernel
179s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 17:01

Target

QtGui4.dll
Size

11.9MB
MD5

3291aafe33b452473c56941ca6b5a306
SHA1

5f113505800ecb980613c9300b34bf8232269dfc
SHA256

810989ff5c2014321c605424b3ce72a75744dc3bb80058c549edc6de56d563f0
SHA512

3fd2b0ab4abc1ed510284ec7025a89fb82431a2a32d2ed55d80723f3bc1565a83db5896ffed5f5729a181d05a191aae445c889ed2787f30ef362a54513efa791
SSDEEP

98304:0M4h2yAhiY1d7BnR4uf4ZLD7JYFyY/6rqCtHV2:X4AhiQnLgD7JJY/6rqCtHV2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2572	2600	rundll32.exe	30
PID 2600 wrote to memory of 2572	2600	rundll32.exe	30
PID 2600 wrote to memory of 2572	2600	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtGui4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2600 -s 244
  2⤵
  PID:2572

memory/2600-0-0x000000006E0C0000-0x000000006E41A000-memory.dmp

Filesize
3.4MB

Download
memory/2600-1-0x0000000067700000-0x00000000682FA000-memory.dmp

Filesize
12.0MB

Download
memory/2600-3-0x0000000063180000-0x000000006319C000-memory.dmp

Filesize
112KB

Download
memory/2600-4-0x000000006A5C0000-0x000000006A6FC000-memory.dmp

Filesize
1.2MB

Download
memory/2600-5-0x0000000062E80000-0x0000000062EB5000-memory.dmp

Filesize
212KB

Download