b06842757fdca6faf5f5509093fc50ee620e0f183882438221e27acae4d9e33f | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 17:02

Sharing

Report Analysis Logs

General

Target

Qt5Core.dll
Size

4.9MB
MD5

654066988aeb0cd09694246edbff173d
SHA1

11791f496b8ca27d78c7885fb77af5fd3dd11d24
SHA256

cd98c1a8299a17906bc1cb553de33ee1b24e0fa728c15fc4beb5b802f09b774d
SHA512

f64af9de23eae4bc6a96766c894fcd638a38cfa61d257e641f56963dd477b19a47f1b8cce41ea01d9c358a8b5699d43dd2a136b20e2f351845425fae6c3e3bb9
SSDEEP

98304:l6M7mcTCIYMlJsv6tWKFdu9C/vWRnZyPPvRE:lF7nJsv6tWKFdu9C/mcRE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe
PID 2392 wrote to memory of 2544	2392	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll,#1
2⤵
PID:2544

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...