5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324

Analysis

max time kernel
1771s
max time network
1160s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:51

Target

QtNetwork4.dll
Size

1010KB
MD5

91ecdb5de396a4a61cd1bbb974a8b00f
SHA1

6639f7aa4ea1747b6f03e59b8fdd114655fd32a9
SHA256

56112b07ad93b8f21d0d9111bfbc759e4bd4ee2253a727a26c3c6f1d2d4aeec8
SHA512

068b8d42fd4e832435694ca54ef73ec0d5e2f555323245c7dc7ab26633628dd2bb07fb9d809e7a75ebed8d237db4c6a1cf92ba15f5c916ebde4050ce14d18db7
SSDEEP

12288:PB2v5dX/m5jrPtkEPSkxqLzZjNO+W0Ga+ECj2YiTPdb4w9S1LI+RTBGEF:PiX/m7k+m9jNOYPCITPdb1S1LI0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4728	4984	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1316 wrote to memory of 4984	1316	rundll32.exe	89
PID 1316 wrote to memory of 4984	1316	rundll32.exe	89
PID 1316 wrote to memory of 4984	1316	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 652
    3⤵
    - Program crash
    PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4984 -ip 4984
1⤵
PID:440