Analysis

  • max time kernel
    254s
  • max time network
    439s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 18:34

General

  • Target

    Qt6Svg.dll

  • Size

    382KB

  • MD5

    ffca13030f4ff87aa94ba1c0b4128227

  • SHA1

    ba5eef498530251b838bb66940e246fecdb01e12

  • SHA256

    903379aad4f65d0323ef293f7cc58cdfcfd8f4bfe61e8d381988c9fb258fa046

  • SHA512

    21c3fdece16ab6cae8db61c6ea846d62b441803b06fcdb5d7409d0e0563e1007f88fde04a3828395ea6f7e19bc7899e731d80d6aa98948a4b4db84b6f47ecc5b

  • SSDEEP

    6144:FanQ3V6kFPcvfDZCHcOkO0qDH5We4ZvJLkM7zoxJlxQfmndQTi3lcvSzdRq8WZ:8nYV6F3V2DZf47LkM7zoxJVnd9lcydve

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt6Svg.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4388 -s 544
      2⤵
        PID:2824

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4388-0-0x00007FFBABBB0000-0x00007FFBABD76000-memory.dmp

      Filesize

      1.8MB

    • memory/4388-1-0x00007FFBBD8C0000-0x00007FFBBD922000-memory.dmp

      Filesize

      392KB

    • memory/4388-3-0x00007FFBAC8E0000-0x00007FFBACEDA000-memory.dmp

      Filesize

      6.0MB

    • memory/4388-2-0x00007FFBAE2E0000-0x00007FFBAE524000-memory.dmp

      Filesize

      2.3MB

    • memory/4388-4-0x00007FFBAC050000-0x00007FFBAC8D5000-memory.dmp

      Filesize

      8.5MB

    • memory/4388-6-0x00007FFBBE060000-0x00007FFBBE077000-memory.dmp

      Filesize

      92KB

    • memory/4388-5-0x00007FFBC4E10000-0x00007FFBC4E34000-memory.dmp

      Filesize

      144KB

    • memory/4388-8-0x00007FFBADB50000-0x00007FFBADC8C000-memory.dmp

      Filesize

      1.2MB

    • memory/4388-7-0x00007FFBAEAA0000-0x00007FFBAEB64000-memory.dmp

      Filesize

      784KB

    • memory/4388-9-0x00007FFBC2920000-0x00007FFBC293E000-memory.dmp

      Filesize

      120KB

    • memory/4388-11-0x00007FFBBD5B0000-0x00007FFBBD5C1000-memory.dmp

      Filesize

      68KB

    • memory/4388-10-0x00007FFBBDF40000-0x00007FFBBDF82000-memory.dmp

      Filesize

      264KB

    • memory/4388-12-0x00007FFBAF0C0000-0x00007FFBAF0DA000-memory.dmp

      Filesize

      104KB

    • memory/4388-13-0x00007FFBABD80000-0x00007FFBAC04E000-memory.dmp

      Filesize

      2.8MB

    • memory/4388-14-0x00007FFBABBB0000-0x00007FFBABD76000-memory.dmp

      Filesize

      1.8MB

    • memory/4388-16-0x00007FFBAEA80000-0x00007FFBAEA9F000-memory.dmp

      Filesize

      124KB

    • memory/4388-15-0x00007FFBAE280000-0x00007FFBAE2E0000-memory.dmp

      Filesize

      384KB

    • memory/4388-17-0x00007FFBAD800000-0x00007FFBAD91E000-memory.dmp

      Filesize

      1.1MB

    • memory/4388-18-0x00007FFBAE260000-0x00007FFBAE27A000-memory.dmp

      Filesize

      104KB

    • memory/4388-20-0x00007FFBADB30000-0x00007FFBADB47000-memory.dmp

      Filesize

      92KB

    • memory/4388-19-0x00007FFBABA40000-0x00007FFBABBA6000-memory.dmp

      Filesize

      1.4MB

    • memory/4388-21-0x00007FFBA9CD0000-0x00007FFBABA39000-memory.dmp

      Filesize

      29.4MB

    • memory/4388-22-0x00007FFBA9C60000-0x00007FFBA9CC9000-memory.dmp

      Filesize

      420KB

    • memory/4388-23-0x00007FFBA9C30000-0x00007FFBA9C5D000-memory.dmp

      Filesize

      180KB

    • memory/4388-24-0x00007FFBAD7D0000-0x00007FFBAD7FC000-memory.dmp

      Filesize

      176KB

    • memory/4388-25-0x00007FFBAD790000-0x00007FFBAD7C5000-memory.dmp

      Filesize

      212KB

    • memory/4388-26-0x00007FFBA9A90000-0x00007FFBA9BA9000-memory.dmp

      Filesize

      1.1MB