2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584 | Triage

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:15

Sharing

Report Analysis Logs

General

Target

Qt5WebKitWidgets.dll
Size

229KB
MD5

02e71fbf51367d02838e1b1a925c7de3
SHA1

6f30fc14124b2b7ee77eb765f2137e10b2f313a1
SHA256

7333f3f5a21ca7871ec9b12c2bec8da3c21329d7b2c7f2aad5ac940d7bc624d9
SHA512

fb8a9c921ffa33075bd9d4992e18274925bbb8620c0a98bcff35c12340468820795c9cf6d48211a4774882d6fefafe9a38e6ea58947cef58881a88bdf9650cc6
SSDEEP

6144:XKlA+hujV5DFkAfHWoHkdVEna4xJIfxwLMgS0M+VvP9k4YRw:alAyKU2kk

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2088 3028 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 2088	3028	rundll32.exe	WerFault.exe
PID 3028 wrote to memory of 2088	3028	rundll32.exe	WerFault.exe
PID 3028 wrote to memory of 2088	3028	rundll32.exe	WerFault.exe
PID 3028 wrote to memory of 2088	3028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5WebKitWidgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5WebKitWidgets.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 284
3⤵
- Program crash
PID:2088

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...