f62712e793e7109552e2cb9c1a57c269be95eb4be1226c5d5ea481229d513ebb | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07-06-2024 10:33

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Qt5Widgets.dll
Size

4.3MB
MD5

0437c572b8692fe4d9ab3227b935f6d0
SHA1

91a586716b48f790521fc40c3b0b80c0dd16f5d0
SHA256

4ce775b049018e12196fd710c6b5d390562fedcfb283433628a3f1079574b7c1
SHA512

cf5fd292455c57a6e92f0f98da526c1d911a1ee54cae2dec45fa75d1bd09490cde95933a26778c1ce45f0f59a54701ec0dd12e7b7867c30bdf37fc48784107fc
SSDEEP

49152:X5N7zE3z3bI7+5r1lGIYpd1vVEAyLQlB1HgIOg3r9zpCYR0WmcK:pyIQH0BKO0WHK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2792 2592 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1500 wrote to memory of 2592	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 2592	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 2592	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 2592	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 2592	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 2592	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 2592	1500	rundll32.exe	rundll32.exe
PID 2592 wrote to memory of 2792	2592	rundll32.exe	WerFault.exe
PID 2592 wrote to memory of 2792	2592	rundll32.exe	WerFault.exe
PID 2592 wrote to memory of 2792	2592	rundll32.exe	WerFault.exe
PID 2592 wrote to memory of 2792	2592	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Qt5Widgets.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 248
3⤵
- Program crash
PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads