2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:15

Sharing

Report Analysis Logs

General

Target

Qt5Gui.dll
Size

5.2MB
MD5

ff5a427898147253c594ef567a1ccbdc
SHA1

84a59f455c820dda1ba29b7150b604f5ecdd9454
SHA256

2f6257a9908e8e0890cebbc368c6ff24bf6fb8014356ce901689086a65899c22
SHA512

69f492c0763db30166ce53da3e5c75c817e5dc2367671483d0295854142f44fb68e97bb3454deb01c35d2a5bb6b0edb762b326292f2f6e2c13c510ffc617cd2a
SSDEEP

49152:thR7VlvpczZEgyebEHyyaeo3bMwDLoewKAx/OrBPV5YFCW/zNwbGD:Rvre8yXgwDL4KNWqY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1676 wrote to memory of 1720	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1720	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1720	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1720	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1720	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1720	1676	rundll32.exe	rundll32.exe
PID 1676 wrote to memory of 1720	1676	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Gui.dll,#1
2⤵
PID:1720

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...