2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584 | Triage

Analysis

max time kernel
149s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:15

Sharing

Report Analysis Logs

General

Target

Qt5Xml.dll
Size

159KB
MD5

0a3146fb0c27fa693fa9865df65935ee
SHA1

04df0d07883311ca3183f025d07c334e25b5f41d
SHA256

664a36f83473e6685fa12ea2dcaab84a48bdbd51e37bb6b0f25fd05bb56d554d
SHA512

8ff2257d1ae2ff90d0dc1b0b097db52ff864869de0cf8fe4302fe25fad23dff92d61bff7a68d63ced81c91b50a81687f7fb25837465a82adf19d9d9408b0ae96
SSDEEP

3072:2tw+g2Vs2c1yUJfLxhKeM2NDFU/st1GVG6FUA+gvJ1Qa3lK5atyZMM7JMe:2twr2VHGtXNvt1boJ1Qa3lCMeMe

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1576 5028 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4128 wrote to memory of 5028	4128	rundll32.exe	rundll32.exe
PID 4128 wrote to memory of 5028	4128	rundll32.exe	rundll32.exe
PID 4128 wrote to memory of 5028	4128	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Xml.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4128

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Xml.dll,#1
2⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 664
3⤵
- Program crash
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5028 -ip 5028
1⤵
PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...