b06842757fdca6faf5f5509093fc50ee620e0f183882438221e27acae4d9e33f | Triage

Analysis

max time kernel
140s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2024 17:02

Sharing

Report Analysis Logs

General

Target

Qt5Core.dll
Size

4.9MB
MD5

654066988aeb0cd09694246edbff173d
SHA1

11791f496b8ca27d78c7885fb77af5fd3dd11d24
SHA256

cd98c1a8299a17906bc1cb553de33ee1b24e0fa728c15fc4beb5b802f09b774d
SHA512

f64af9de23eae4bc6a96766c894fcd638a38cfa61d257e641f56963dd477b19a47f1b8cce41ea01d9c358a8b5699d43dd2a136b20e2f351845425fae6c3e3bb9
SSDEEP

98304:l6M7mcTCIYMlJsv6tWKFdu9C/vWRnZyPPvRE:lF7nJsv6tWKFdu9C/mcRE

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3612 1652 WerFault.exe rundll32.exe
1856 1652 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1428 wrote to memory of 1652	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 1652	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 1652	1428	rundll32.exe	rundll32.exe
PID 1652 wrote to memory of 3612	1652	rundll32.exe	WerFault.exe
PID 1652 wrote to memory of 3612	1652	rundll32.exe	WerFault.exe
PID 1652 wrote to memory of 3612	1652	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 676
3⤵
- Program crash
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 676
3⤵
- Program crash
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1652 -ip 1652
1⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads