50623f865bedcea99301e5b33e3c4bedf43e975e6297d5e4291009ef3ecafc35

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 01:55

Target

resources/bin/zenshot/Qt5Network.dll
Size

1.1MB
MD5

57a3618e90618fa434325e478049e5e8
SHA1

c05081caee8bccf27b0995ec3abec6b32234dbc5
SHA256

757ce98e65ade9d093d4e0d2dd9e03b279b1f0f9c5349dde667060a973ffae4d
SHA512

cd59c3bdc57fb0fffc690706a023ff24852997b4e67d854a23fc3d2a6b4fe49aec79b142d88810ac4733986e57ffc4be201b98272bb340df3e100c53ce72c61c
SSDEEP

24576:hNfY4/b8d22Gmou3ZjRkjZgUPiV69DrOMxpqDc0EGQVzKaHBp:5Ad22GrziVaSDcka

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	4416	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 4416	1492	rundll32.exe	86
PID 1492 wrote to memory of 4416	1492	rundll32.exe	86
PID 1492 wrote to memory of 4416	1492	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\Qt5Network.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\Qt5Network.dll,#1
  2⤵
  PID:4416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 716
    3⤵
    - Program crash
    PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4416 -ip 4416
1⤵
PID:2032