acac2e1bad58381fb4fa36027b7e9e8fb15158ef32f36533953f0e24068fe634

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 07:18

Target

QtCore4.dll
Size

2.4MB
MD5

2b04f8d542ec9279899b61054e76126c
SHA1

27427f09bd84fe544b2ca4c1a30e91f88cffeb0a
SHA256

f91bc89d085db4e6ece4937077103afdc449d09894f77bb66490a137063abc6a
SHA512

070252d231eb92a024eccd52a2cabb562f9e8097f4fe7faca9e49df8ca4bacc1e43cf397e9f9c2714d7d49e2e3e775e1ab54d2a9b759a73653a192597709c75a
SSDEEP

49152:/aealY6Y+ranN809vbzKhI9xxUKp/oQpL1hp2Ko7QrjzJsv6tWKFdu9C98TFPuql:/aeaNYganh0E4KqQpL1hp2nQrnJsv6tr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2264	2272	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2272	2144	rundll32.exe	28
PID 2144 wrote to memory of 2272	2144	rundll32.exe	28
PID 2144 wrote to memory of 2272	2144	rundll32.exe	28
PID 2144 wrote to memory of 2272	2144	rundll32.exe	28
PID 2144 wrote to memory of 2272	2144	rundll32.exe	28
PID 2144 wrote to memory of 2272	2144	rundll32.exe	28
PID 2144 wrote to memory of 2272	2144	rundll32.exe	28
PID 2272 wrote to memory of 2264	2272	rundll32.exe	29
PID 2272 wrote to memory of 2264	2272	rundll32.exe	29
PID 2272 wrote to memory of 2264	2272	rundll32.exe	29
PID 2272 wrote to memory of 2264	2272	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtCore4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtCore4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 248
    3⤵
    - Program crash
    PID:2264

memory/2272-2-0x000000006E940000-0x000000006E950000-memory.dmp

Filesize
64KB

Download
memory/2272-1-0x000000006FBC0000-0x000000006FBC7000-memory.dmp

Filesize
28KB

Download
memory/2272-0-0x000000006A1C0000-0x000000006A435000-memory.dmp

Filesize
2.5MB

Download