2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:25

Sharing

Report Analysis Logs

General

Target

Qt5PrintSupport.dll
Size

271KB
MD5

cfa74cc899a426212c1f82b2d1fbe583
SHA1

cc42712a2df7cc7baa5a4c7e0ddf95008c1e33f4
SHA256

1d7d0684d22b20b6d96b64325100364e9bce95de9d962812518da7ac80f12424
SHA512

7e3883913f4916858d61abc91dbf84af64be9945056264ab94b543813cd69e2240c963b888b8b17428b7395126542d9c4606ce0822d02937e41bb35ca1f63b57
SSDEEP

6144:6VFeifiHgE1SCAR9a4/UBt3Phcl3I90HMeG0tKhCPxS+plM4tPER0FEj/3cA28mL:6bEU93/0zYce

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1664 2348 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2328 wrote to memory of 2348	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2348	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2348	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2348	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2348	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2348	2328	rundll32.exe	rundll32.exe
PID 2328 wrote to memory of 2348	2328	rundll32.exe	rundll32.exe
PID 2348 wrote to memory of 1664	2348	rundll32.exe	WerFault.exe
PID 2348 wrote to memory of 1664	2348	rundll32.exe	WerFault.exe
PID 2348 wrote to memory of 1664	2348	rundll32.exe	WerFault.exe
PID 2348 wrote to memory of 1664	2348	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5PrintSupport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5PrintSupport.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 264
    3⤵
    - Program crash
    PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads