3c3cf3d710582ccbb7a45139c1acc3a8d6bcfc017b9a4aeae6bf34a292f057cd | Triage

Analysis

max time kernel
135s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 00:13

Sharing

Report Analysis Logs

General

Target

Qt5Core.dll
Size

4.3MB
MD5

e009fa6b9cd814e7f0c47989064ba0cf
SHA1

d7978b907d28510a11d938625fce3bb249fd2e3b
SHA256

f7dd1e22b136d0edbdc230eabcabd28fcaf43ffd798001de40ef84d80095d580
SHA512

b82db43b3950f7c29fc584d5bbc41a8dcf27d38c54077b81277de18bb052fc076c039827eef1f32fa55788eee1659ba6289b72ada858e4dc79eb0214c8829b8b
SSDEEP

98304:dlFjspp9Z4tkHj2FHH/eyrGJsv6tWKFdu9C76DqF:ljspp9Z46HiFGJsv6tWKFdu9CGc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5012 4392 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2996 wrote to memory of 4392	2996	rundll32.exe	rundll32.exe
PID 2996 wrote to memory of 4392	2996	rundll32.exe	rundll32.exe
PID 2996 wrote to memory of 4392	2996	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll,#1
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 648
    3⤵
    - Program crash
    PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4392 -ip 4392
1⤵
PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads