50623f865bedcea99301e5b33e3c4bedf43e975e6297d5e4291009ef3ecafc35

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 01:55

Target

resources/bin/zenshot/Qt5Widgets.dll
Size

4.4MB
MD5

6ed28be1c72c4ebfe33e7972f68c88f8
SHA1

6f5a4832c81db6dba7404fed05438e586f5e1aea
SHA256

2cae494dc1e85e77da97750a52a6a628560c8db5c102e9a69e4c40a1bd4a74f6
SHA512

62c6fe09c4b3bf3af466f5db575f2396c012dace1b86a9f30529aa3f5c64b5eaa3600c0581482baf16b7842524e912841581dc8617fd4c4e6ff4c57800d72de2
SSDEEP

98304:81CmFlF05UMNO1ulAjhDfTbz7quDp+bXa6gYzdkSPD1UZlH6uV75uDdHBclxooGc:Cf59iJ5u

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2268	2924	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2912 wrote to memory of 2924	2912	rundll32.exe	28
PID 2924 wrote to memory of 2268	2924	rundll32.exe	29
PID 2924 wrote to memory of 2268	2924	rundll32.exe	29
PID 2924 wrote to memory of 2268	2924	rundll32.exe	29
PID 2924 wrote to memory of 2268	2924	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\bin\zenshot\Qt5Widgets.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 256
    3⤵
    - Program crash
    PID:2268