f62712e793e7109552e2cb9c1a57c269be95eb4be1226c5d5ea481229d513ebb | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 10:33

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Qt5Widgets.dll
Size

4.3MB
MD5

0437c572b8692fe4d9ab3227b935f6d0
SHA1

91a586716b48f790521fc40c3b0b80c0dd16f5d0
SHA256

4ce775b049018e12196fd710c6b5d390562fedcfb283433628a3f1079574b7c1
SHA512

cf5fd292455c57a6e92f0f98da526c1d911a1ee54cae2dec45fa75d1bd09490cde95933a26778c1ce45f0f59a54701ec0dd12e7b7867c30bdf37fc48784107fc
SSDEEP

49152:X5N7zE3z3bI7+5r1lGIYpd1vVEAyLQlB1HgIOg3r9zpCYR0WmcK:pyIQH0BKO0WHK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1872	4776	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 4776	2544	rundll32.exe	87
PID 2544 wrote to memory of 4776	2544	rundll32.exe	87
PID 2544 wrote to memory of 4776	2544	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Qt5Widgets.dll,#1
  2⤵
  PID:4776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 684
    3⤵
    - Program crash
    PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4776 -ip 4776
1⤵
PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads