b06842757fdca6faf5f5509093fc50ee620e0f183882438221e27acae4d9e33f | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-04-2024 17:02

Sharing

Report Analysis Logs

General

Target

Qt5Widgets.dll
Size

4.3MB
MD5

b2b002c566edabcc6be3ee449699e707
SHA1

d80645cdf0be47b2f4eff58a6a474b81177cd112
SHA256

535c0b78c757fe6f11c4369b5b6993a3dd850b0269e4d0d2d0e5bf24d933f29b
SHA512

33eeaca82949103960b7d141d4e20414c399f385b5d7f7589b21362eaad0b6fd28beec224b1654c420ff38a78f3cec2fd72926af872ec01acfcdbbf56f853525
SSDEEP

49152:B5PJKhgOVwTngFLmM4GDVdGOZd31nvXhUjJKtjc1k374FG:BygO8ehvq2cFG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1544 1044 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1964 wrote to memory of 1044	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1044	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1044	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1044	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1044	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1044	1964	rundll32.exe	rundll32.exe
PID 1964 wrote to memory of 1044	1964	rundll32.exe	rundll32.exe
PID 1044 wrote to memory of 1544	1044	rundll32.exe	WerFault.exe
PID 1044 wrote to memory of 1544	1044	rundll32.exe	WerFault.exe
PID 1044 wrote to memory of 1544	1044	rundll32.exe	WerFault.exe
PID 1044 wrote to memory of 1544	1044	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 248
3⤵
- Program crash
PID:1544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads