47e810d2661b47d7419c6ca876feeeaa900ae86880c00627a218d2c4d918927f | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 02:19

Sharing

Report Analysis Logs

General

Target

lib/PySide2.QtQuickControls2.dll
Size

37KB
MD5

82695cac0bf048d9f76a93873c16695e
SHA1

73d842497d16fec878621b27c6f61df20a852823
SHA256

f11659f6b16479028d221b7629bd46bf6809544d41c17c9c41f0b944f5022cad
SHA512

9203da6150a604d470a95b4ce52713893e9f8d1a0f5cf56d3101eb386e2b78a9d39d233afb23761fde04b1d4369a7c357ee9b0567d5073bcc55d4875f38bd2bf
SSDEEP

768:1wyh3wO4agyLmN/iyGJ5ezgKO0aiZnVbZuGN266IO:ZiagySN/iyGJ5ezgKOonPL6IO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1468	912	rundll32.exe	28
PID 912 wrote to memory of 1468	912	rundll32.exe	28
PID 912 wrote to memory of 1468	912	rundll32.exe	28
PID 912 wrote to memory of 1468	912	rundll32.exe	28
PID 912 wrote to memory of 1468	912	rundll32.exe	28
PID 912 wrote to memory of 1468	912	rundll32.exe	28
PID 912 wrote to memory of 1468	912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtQuickControls2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\PySide2.QtQuickControls2.dll,#1
  2⤵
  PID:1468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads