36a00c545e5fdbd5712eb468099a211dccf17812a0cb08efde9d3ddce7181c5e | Triage

Resubmissions

28/05/2024, 11:02

240528-m5c1wagd7x 10

06/05/2024, 13:53

240506-q6ywhsde4z 3

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 13:53

Sharing

Report Analysis Logs

General

Target

Qt5Positioning.dll
Size

253KB
MD5

7564b2125d2554c98d92d20295d0515a
SHA1

1604d1ab6e424cab14e1f985f288b4197023f548
SHA256

1225b627e5267a9a758af530e7fc842e3ac1c054647ae061a524f8a059a87879
SHA512

cae8d731ee8cc5be31403bd32a7118075f0b708bca667a7c41eb876f15d60570b61626fecc1fe61b69313d7305ffaae80209c35bd68e02a48229692621633922
SSDEEP

6144:uMhArVhgRv3sIEO9Qf3K+sclzXhbitZG3d5W:QPs8I79QPK+RTjW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 3604	3104	rundll32.exe	90
PID 3104 wrote to memory of 3604	3104	rundll32.exe	90
PID 3104 wrote to memory of 3604	3104	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Positioning.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Positioning.dll,#1
  2⤵
  PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads