47e810d2661b47d7419c6ca876feeeaa900ae86880c00627a218d2c4d918927f | Triage

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 02:19

Sharing

Report Analysis Logs

General

Target

lib/PySide2.QtNetwork.dll
Size

856KB
MD5

e315805d8857bf7543c39ca3dc8a9f72
SHA1

52042404dcb7d3f4d2def77882094824b029fd07
SHA256

3c6101d9d387a310947cf347da9958d90db6ec617037695fec79e37c3b516559
SHA512

f1f5bb070ee4634909374e8f1975d8358166190248901ec1441b51a34231c21ef099e0467658c590443481fa1c914230e8a9f9b6acf1c56402b16ae6a0bff96d
SSDEEP

12288:OF9NvHzmnhgxvHYjxyEVs7qZFg0bshR1fND3w:8/vHYjxyEVs78Fg0oh9w

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2652	2580	rundll32.exe	27
PID 2580 wrote to memory of 2652	2580	rundll32.exe	27
PID 2580 wrote to memory of 2652	2580	rundll32.exe	27
PID 2580 wrote to memory of 2652	2580	rundll32.exe	27
PID 2580 wrote to memory of 2652	2580	rundll32.exe	27
PID 2580 wrote to memory of 2652	2580	rundll32.exe	27
PID 2580 wrote to memory of 2652	2580	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtNetwork.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtNetwork.dll,#1
  2⤵
  PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads