50623f865bedcea99301e5b33e3c4bedf43e975e6297d5e4291009ef3ecafc35 | Triage

Analysis

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 01:55

Sharing

Report Analysis Logs

General

Target

resources/bin/zenshot/Qt5Gui.dll
Size

5.7MB
MD5

26e939424e333cb2c71cadd5df76aa40
SHA1

56a2b2fb7d0d11407b21ef5409e768d8735482a6
SHA256

8b12aacf901a17a73e495c7277a1249c56c7c5dbbd0a64b85bda54b9dab043c9
SHA512

b8d282be49f70a9ec3a4ef9dfd7c9f8df70dabf9d8b13d8363daf0afc2956fc29477c1d6de41e791bb2de678adaef23b992dd1665bace1c9e8ff5d14b86ea66e
SSDEEP

98304:98oNJzx4w24LwWotu+PNlwL9PmEZ23Cec:nBbUuCPwNj2CR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 3756	4820	rundll32.exe	86
PID 4820 wrote to memory of 3756	4820	rundll32.exe	86
PID 4820 wrote to memory of 3756	4820	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\Qt5Gui.dll,#1
  2⤵
  PID:3756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads