5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324 | Triage

Analysis

max time kernel
1s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:42

Sharing

Report Analysis Logs

General

Target

QtGui4.dll
Size

8.2MB
MD5

7a2829da1f1f4112d984a13bc71b95f5
SHA1

5020a69619da503e44991a1da3ec84bdf963d9b4
SHA256

cfd06dea104f9c3580fab2f5d64019829b056e55d44695764521011abfe946d4
SHA512

5f0f72884e1fb491403e99ec2a1dc900873480f9ee4a648b9cfc23d0004f4758867757b98191d3892ad342c585ecd75b0dbfa5416a02955d6ef52e99c5fdbc4c
SSDEEP

98304:yxyhZcJJbOVZCAUSORHQQwkwPG1d0y+SzOyG5F4bVBm6Qa8vIEcw3:yxkZclAUTH/wkSGmWBKIE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2428	1104	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 724 wrote to memory of 1104	724	rundll32.exe	83
PID 724 wrote to memory of 1104	724	rundll32.exe	83
PID 724 wrote to memory of 1104	724	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtGui4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtGui4.dll,#1
  2⤵
  PID:1104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 692
    3⤵
    - Program crash
    PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1104 -ip 1104
1⤵
PID:1632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads