b06842757fdca6faf5f5509093fc50ee620e0f183882438221e27acae4d9e33f | Triage

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2024 17:02

Sharing

Report Analysis Logs

General

Target

Qt5Gui.dll
Size

5.1MB
MD5

c0c744173d3d9fb437984193bcbf172a
SHA1

a2c30a63838650cf01a7b4d4524f59ed42ec98d9
SHA256

5588d0147628851f0eadb5707dfa2e4f6d80bea3eb6b63b50b2a7ef4d3543d77
SHA512

d952903e6079d1e4050ec179fbdad86ffd850a16f0e543f828437b5a4b8c8d7506d3c0418f4f245ce9a30e0cd833c900984cb6599c0ea774583bf12e6a82aace
SSDEEP

49152:LE2ybhHfoyRR3dYvjjSXSkvw5C2wRmxdUysGatNNSmrfO/DXZcIQ:reA0FWvvSXTB2XSfAQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1180 wrote to memory of 1204	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 1204	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 1204	1180	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Gui.dll,#1
2⤵
PID:1204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...