3fa4c62861f73439e7c877b096a64a5e3fe6057fd07b7a508252b6bceeb04944 | Triage

Analysis

max time kernel
133s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 06:17

Sharing

Report Analysis Logs

General

Target

$SYSDIR/Qt5Positioning.dll
Size

253KB
MD5

7564b2125d2554c98d92d20295d0515a
SHA1

1604d1ab6e424cab14e1f985f288b4197023f548
SHA256

1225b627e5267a9a758af530e7fc842e3ac1c054647ae061a524f8a059a87879
SHA512

cae8d731ee8cc5be31403bd32a7118075f0b708bca667a7c41eb876f15d60570b61626fecc1fe61b69313d7305ffaae80209c35bd68e02a48229692621633922
SSDEEP

6144:uMhArVhgRv3sIEO9Qf3K+sclzXhbitZG3d5W:QPs8I79QPK+RTjW

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3412 wrote to memory of 3048	3412	rundll32.exe	rundll32.exe
PID 3412 wrote to memory of 3048	3412	rundll32.exe	rundll32.exe
PID 3412 wrote to memory of 3048	3412	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5Positioning.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\Qt5Positioning.dll,#1
2⤵
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...