5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324 | Triage

Analysis

max time kernel
1700s
max time network
1173s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 19:58

Sharing

Report Analysis Logs

General

Target

QtGui4.dll
Size

8.2MB
MD5

7a2829da1f1f4112d984a13bc71b95f5
SHA1

5020a69619da503e44991a1da3ec84bdf963d9b4
SHA256

cfd06dea104f9c3580fab2f5d64019829b056e55d44695764521011abfe946d4
SHA512

5f0f72884e1fb491403e99ec2a1dc900873480f9ee4a648b9cfc23d0004f4758867757b98191d3892ad342c585ecd75b0dbfa5416a02955d6ef52e99c5fdbc4c
SSDEEP

98304:yxyhZcJJbOVZCAUSORHQQwkwPG1d0y+SzOyG5F4bVBm6Qa8vIEcw3:yxkZclAUTH/wkSGmWBKIE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	4424	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4424	4972	rundll32.exe	84
PID 4972 wrote to memory of 4424	4972	rundll32.exe	84
PID 4972 wrote to memory of 4424	4972	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtGui4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtGui4.dll,#1
  2⤵
  PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 692
    3⤵
    - Program crash
    PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4424 -ip 4424
1⤵
PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads