80abc14026ede9a9d0b601f925dfed172e6443eb20c63786866760395b1cb79b

Analysis

max time kernel
144s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 17:01

Target

QtOpenGL4.dll
Size

1.1MB
MD5

f7e9f72d08f06eeda48ad60e95563004
SHA1

88372bc4704185433a61253e1ad5825b3ae3659b
SHA256

ef8a584fe842551ebbbad02569498c718b16adf6977a7263ddef92651e2b98ec
SHA512

1dcfee53a89e084861222ff50cb566ee8f1515a03a2e93aa41440dbebf2d788324588850797cef7f2c398f0351db8b3459a24c877160cb3411acbc31654c0b66
SSDEEP

12288:zY1OPzDCh5dzhW9uOp/KST5tol8XEAD+cn6Y7Q+6Pn0652G/PJeO2wYwr261Z9qt:c072JiOMOhtw06hmZkaC6WbI

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1912	1772	rundll32.exe	28
PID 1772 wrote to memory of 1912	1772	rundll32.exe	28
PID 1772 wrote to memory of 1912	1772	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtOpenGL4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1772 -s 344
  2⤵
  PID:1912

memory/1772-0-0x000000006E0C0000-0x000000006E41A000-memory.dmp

Filesize
3.4MB

Download
memory/1772-1-0x0000000067700000-0x00000000682FA000-memory.dmp

Filesize
12.0MB

Download
memory/1772-2-0x000000006EF80000-0x000000006F0A8000-memory.dmp

Filesize
1.2MB

Download
memory/1772-3-0x0000000063180000-0x000000006319C000-memory.dmp

Filesize
112KB

Download
memory/1772-4-0x000000006A5C0000-0x000000006A6FC000-memory.dmp

Filesize
1.2MB

Download
memory/1772-5-0x000000006E0C0000-0x000000006E41A000-memory.dmp

Filesize
3.4MB

Download
memory/1772-6-0x0000000062E80000-0x0000000062EB5000-memory.dmp

Filesize
212KB

Download