2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584 | Triage

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:15

Sharing

Report Analysis Logs

General

Target

Qt5PrintSupport.dll
Size

271KB
MD5

cfa74cc899a426212c1f82b2d1fbe583
SHA1

cc42712a2df7cc7baa5a4c7e0ddf95008c1e33f4
SHA256

1d7d0684d22b20b6d96b64325100364e9bce95de9d962812518da7ac80f12424
SHA512

7e3883913f4916858d61abc91dbf84af64be9945056264ab94b543813cd69e2240c963b888b8b17428b7395126542d9c4606ce0822d02937e41bb35ca1f63b57
SSDEEP

6144:6VFeifiHgE1SCAR9a4/UBt3Phcl3I90HMeG0tKhCPxS+plM4tPER0FEj/3cA28mL:6bEU93/0zYce

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2660 776 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1740 wrote to memory of 776	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 776	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 776	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 776	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 776	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 776	1740	rundll32.exe	rundll32.exe
PID 1740 wrote to memory of 776	1740	rundll32.exe	rundll32.exe
PID 776 wrote to memory of 2660	776	rundll32.exe	WerFault.exe
PID 776 wrote to memory of 2660	776	rundll32.exe	WerFault.exe
PID 776 wrote to memory of 2660	776	rundll32.exe	WerFault.exe
PID 776 wrote to memory of 2660	776	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5PrintSupport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5PrintSupport.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 264
3⤵
- Program crash
PID:2660

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...