2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584 | Triage

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:15

Sharing

Report Analysis Logs

General

Target

Qt5WebKit.dll
Size

34.5MB
MD5

404d9879e3389a9f92d3c1e1b9650306
SHA1

3200e9cb698a995605014b1342da59745f2fc9f7
SHA256

a6465c2c4e5f72712f1d67818a675416fdc5d264b0176b991122ff00a428efd1
SHA512

3050686dbe06ec3289ac64ed5ba24697fb8abbf06d65d498464093240f6c41833394e6dfde5ac74d380408ef80eeff5f2b1d887c5df9815dba04eb2922772e0e
SSDEEP

393216:469BQY6Mi56onRz1StQcoLaD6ijfPWZSWlH80GoW+ekpb:ZQm8vSCxafPWZSWlcDD+ekpb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2036 2056 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2488 wrote to memory of 2056	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2056	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2056	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2056	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2056	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2056	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 2056	2488	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 2036	2056	rundll32.exe	WerFault.exe
PID 2056 wrote to memory of 2036	2056	rundll32.exe	WerFault.exe
PID 2056 wrote to memory of 2036	2056	rundll32.exe	WerFault.exe
PID 2056 wrote to memory of 2036	2056	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5WebKit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5WebKit.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 264
3⤵
- Program crash
PID:2036

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...