0d8e2f68ce537be331fb8776d6d2e118da87bb31fd7f266392d382f92dc5193d | Triage

Analysis

max time kernel
153s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:05

Sharing

Report Analysis Logs

General

Target

Qt5QuickWidgets.dll
Size

66KB
MD5

0c1210b83e965e391ec725811f4c233f
SHA1

156b414ee4d78df6efc37717434dd4428cc5f9d0
SHA256

ee8ecdb086359fefc14f82cc2aac7b572a471264ff756e848615cafce72c98b0
SHA512

b82e5f871cf4b57b7bfd34d6413b070adbb63872ef12e2a1bcede47a59721d210f843e2eb6d15ccfd66578bfb71afd1e57b61815a0951919245a5499066140df
SSDEEP

1536:1b32hJ44pc5UJPkKRKQHiEPWuCivyMGIj/zRUCqr26dZUfS:1bm74SqdKRhHiOWuCUfGIzzRUCqr2qb

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4352 wrote to memory of 4584	4352	rundll32.exe	rundll32.exe
PID 4352 wrote to memory of 4584	4352	rundll32.exe	rundll32.exe
PID 4352 wrote to memory of 4584	4352	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5QuickWidgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4352

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5QuickWidgets.dll,#1
2⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3540 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:4148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads