2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584 | Triage

Analysis

max time kernel
150s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:15

Sharing

Report Analysis Logs

General

Target

Qt5Gui.dll
Size

5.2MB
MD5

ff5a427898147253c594ef567a1ccbdc
SHA1

84a59f455c820dda1ba29b7150b604f5ecdd9454
SHA256

2f6257a9908e8e0890cebbc368c6ff24bf6fb8014356ce901689086a65899c22
SHA512

69f492c0763db30166ce53da3e5c75c817e5dc2367671483d0295854142f44fb68e97bb3454deb01c35d2a5bb6b0edb762b326292f2f6e2c13c510ffc617cd2a
SSDEEP

49152:thR7VlvpczZEgyebEHyyaeo3bMwDLoewKAx/OrBPV5YFCW/zNwbGD:Rvre8yXgwDL4KNWqY

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 540 wrote to memory of 2624	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 2624	540	rundll32.exe	rundll32.exe
PID 540 wrote to memory of 2624	540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Gui.dll,#1
2⤵
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...