36a00c545e5fdbd5712eb468099a211dccf17812a0cb08efde9d3ddce7181c5e | Triage

Resubmissions

28/05/2024, 11:02

240528-m5c1wagd7x 10

06/05/2024, 13:53

240506-q6ywhsde4z 3

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 13:53

Sharing

Report Analysis Logs

General

Target

Qt5QuickWidgets.dll
Size

66KB
MD5

0c1210b83e965e391ec725811f4c233f
SHA1

156b414ee4d78df6efc37717434dd4428cc5f9d0
SHA256

ee8ecdb086359fefc14f82cc2aac7b572a471264ff756e848615cafce72c98b0
SHA512

b82e5f871cf4b57b7bfd34d6413b070adbb63872ef12e2a1bcede47a59721d210f843e2eb6d15ccfd66578bfb71afd1e57b61815a0951919245a5499066140df
SSDEEP

1536:1b32hJ44pc5UJPkKRKQHiEPWuCivyMGIj/zRUCqr26dZUfS:1bm74SqdKRhHiOWuCUfGIzzRUCqr2qb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 5068	1604	rundll32.exe	84
PID 1604 wrote to memory of 5068	1604	rundll32.exe	84
PID 1604 wrote to memory of 5068	1604	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5QuickWidgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5QuickWidgets.dll,#1
  2⤵
  PID:5068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads