a14fa40b174aa50e6ca01dcf32a346c1eae8737eb6ed93a558cdeb601b86986b

Resubmissions

09/06/2024, 10:21

09/06/2024, 10:21

09/06/2024, 10:08

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 10:21

Target
DLL/Qt5Network.dll
Size 1.0MB
Sample240609-md1b4aaa48
SHA256 10fabe35ca0b0b9c35c2f618c801fb999bde09572a7fa10415b2b3f6b6470a7d
MD5 11c016d03aefc9e124828cb7cd775cf3
SHA1 cfdcf0bf5834e507cf87c7e283d14a7c89aa2628
SHA512 87cc26fee8033ce638828fb773f62704f48a20c042faf70c9f97e9f1d76a09e6060c818ad2d4cd6cccaf4464fb23e9bcfc77d53a6f24415aa0d83455260ce36d
SSDEEP 24576:rC99Z7u86aKFihx3g1J6wr/zv+p6FhvWFCS4XaQli:v86aKYNaGqhecXN0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4960	368	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 368	3480	rundll32.exe	83
PID 3480 wrote to memory of 368	3480	rundll32.exe	83
PID 3480 wrote to memory of 368	3480	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\Qt5Network.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\Qt5Network.dll,#1
  2⤵
  PID:368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 724
    3⤵
    - Program crash
    PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 368 -ip 368
1⤵
PID:4708