2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584 | Triage

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:15

Sharing

Report Analysis Logs

General

Target

Qt5Xml.dll
Size

159KB
MD5

0a3146fb0c27fa693fa9865df65935ee
SHA1

04df0d07883311ca3183f025d07c334e25b5f41d
SHA256

664a36f83473e6685fa12ea2dcaab84a48bdbd51e37bb6b0f25fd05bb56d554d
SHA512

8ff2257d1ae2ff90d0dc1b0b097db52ff864869de0cf8fe4302fe25fad23dff92d61bff7a68d63ced81c91b50a81687f7fb25837465a82adf19d9d9408b0ae96
SSDEEP

3072:2tw+g2Vs2c1yUJfLxhKeM2NDFU/st1GVG6FUA+gvJ1Qa3lK5atyZMM7JMe:2twr2VHGtXNvt1boJ1Qa3lCMeMe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2692 2684 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2012 wrote to memory of 2684	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2684	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2684	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2684	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2684	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2684	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2684	2012	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 2692	2684	rundll32.exe	WerFault.exe
PID 2684 wrote to memory of 2692	2684	rundll32.exe	WerFault.exe
PID 2684 wrote to memory of 2692	2684	rundll32.exe	WerFault.exe
PID 2684 wrote to memory of 2692	2684	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Xml.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Xml.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 248
3⤵
- Program crash
PID:2692

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...