f62712e793e7109552e2cb9c1a57c269be95eb4be1226c5d5ea481229d513ebb | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 10:33

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Qt5Widgets.dll
Size

4.3MB
MD5

0437c572b8692fe4d9ab3227b935f6d0
SHA1

91a586716b48f790521fc40c3b0b80c0dd16f5d0
SHA256

4ce775b049018e12196fd710c6b5d390562fedcfb283433628a3f1079574b7c1
SHA512

cf5fd292455c57a6e92f0f98da526c1d911a1ee54cae2dec45fa75d1bd09490cde95933a26778c1ce45f0f59a54701ec0dd12e7b7867c30bdf37fc48784107fc
SSDEEP

49152:X5N7zE3z3bI7+5r1lGIYpd1vVEAyLQlB1HgIOg3r9zpCYR0WmcK:pyIQH0BKO0WHK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1872 4776 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2544 wrote to memory of 4776	2544	rundll32.exe	rundll32.exe
PID 2544 wrote to memory of 4776	2544	rundll32.exe	rundll32.exe
PID 2544 wrote to memory of 4776	2544	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Qt5Widgets.dll,#1
2⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 684
3⤵
- Program crash
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4776 -ip 4776
1⤵
PID:2696

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...