2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584 | Triage

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:15

Sharing

Report Analysis Logs

General

Target

Qt5Svg.dll
Size

308KB
MD5

d62af9cefed0bfed09017b21f66653ea
SHA1

9306e0b49024cb9905b3dab26ea180fd50c0f267
SHA256

d9bb5bd0928c7c67e3ab9b5cbaf2f79ccc52bf93e783667412d7b45b2ec20c4f
SHA512

2d45b546c28045a6d895b3adad96419d71ac0d02b1481e463e16d9c74a3c02f05069afc67c37338fda7c3d8675774278627b3c5a3904762c95b8f02c0be42005
SSDEEP

6144:bxLY3I53XvOkdkHogyQsokNYgYnrUuQG+3m2uAVJUVXpyYvYPK151QPwc8JUp8dy:75nfNYgsrUuQXm2uAVJidy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1884 2852 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2804 wrote to memory of 2852	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2852	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2852	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2852	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2852	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2852	2804	rundll32.exe	rundll32.exe
PID 2804 wrote to memory of 2852	2804	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 1884	2852	rundll32.exe	WerFault.exe
PID 2852 wrote to memory of 1884	2852	rundll32.exe	WerFault.exe
PID 2852 wrote to memory of 1884	2852	rundll32.exe	WerFault.exe
PID 2852 wrote to memory of 1884	2852	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Svg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Svg.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 244
3⤵
- Program crash
PID:1884

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...