acac2e1bad58381fb4fa36027b7e9e8fb15158ef32f36533953f0e24068fe634

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 07:18

Target

QtCore4.dll
Size

2.4MB
MD5

2b04f8d542ec9279899b61054e76126c
SHA1

27427f09bd84fe544b2ca4c1a30e91f88cffeb0a
SHA256

f91bc89d085db4e6ece4937077103afdc449d09894f77bb66490a137063abc6a
SHA512

070252d231eb92a024eccd52a2cabb562f9e8097f4fe7faca9e49df8ca4bacc1e43cf397e9f9c2714d7d49e2e3e775e1ab54d2a9b759a73653a192597709c75a
SSDEEP

49152:/aealY6Y+ranN809vbzKhI9xxUKp/oQpL1hp2Ko7QrjzJsv6tWKFdu9C98TFPuql:/aeaNYganh0E4KqQpL1hp2nQrnJsv6tr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2740	916	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 916	3928	rundll32.exe	84
PID 3928 wrote to memory of 916	3928	rundll32.exe	84
PID 3928 wrote to memory of 916	3928	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtCore4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtCore4.dll,#1
  2⤵
  PID:916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 668
    3⤵
    - Program crash
    PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 916 -ip 916
1⤵
PID:3904

memory/916-2-0x000000006E940000-0x000000006E950000-memory.dmp

Filesize
64KB

Download
memory/916-1-0x000000006FBC0000-0x000000006FBC7000-memory.dmp

Filesize
28KB

Download
memory/916-0-0x000000006A1C0000-0x000000006A435000-memory.dmp

Filesize
2.5MB

Download