50623f865bedcea99301e5b33e3c4bedf43e975e6297d5e4291009ef3ecafc35

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 01:55

Target

resources/bin/zenshot/Qt5Network.dll
Size

1.1MB
MD5

57a3618e90618fa434325e478049e5e8
SHA1

c05081caee8bccf27b0995ec3abec6b32234dbc5
SHA256

757ce98e65ade9d093d4e0d2dd9e03b279b1f0f9c5349dde667060a973ffae4d
SHA512

cd59c3bdc57fb0fffc690706a023ff24852997b4e67d854a23fc3d2a6b4fe49aec79b142d88810ac4733986e57ffc4be201b98272bb340df3e100c53ce72c61c
SSDEEP

24576:hNfY4/b8d22Gmou3ZjRkjZgUPiV69DrOMxpqDc0EGQVzKaHBp:5Ad22GrziVaSDcka

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	2968	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2968	2952	rundll32.exe	28
PID 2952 wrote to memory of 2968	2952	rundll32.exe	28
PID 2952 wrote to memory of 2968	2952	rundll32.exe	28
PID 2952 wrote to memory of 2968	2952	rundll32.exe	28
PID 2952 wrote to memory of 2968	2952	rundll32.exe	28
PID 2952 wrote to memory of 2968	2952	rundll32.exe	28
PID 2952 wrote to memory of 2968	2952	rundll32.exe	28
PID 2968 wrote to memory of 2972	2968	rundll32.exe	29
PID 2968 wrote to memory of 2972	2968	rundll32.exe	29
PID 2968 wrote to memory of 2972	2968	rundll32.exe	29
PID 2968 wrote to memory of 2972	2968	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\Qt5Network.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\Qt5Network.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 264
    3⤵
    - Program crash
    PID:2972