b06842757fdca6faf5f5509093fc50ee620e0f183882438221e27acae4d9e33f | Triage

Analysis

max time kernel
51s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 08:38

Sharing

Report Analysis Logs

General

Target

Qt5Core.dll
Size

4.9MB
MD5

654066988aeb0cd09694246edbff173d
SHA1

11791f496b8ca27d78c7885fb77af5fd3dd11d24
SHA256

cd98c1a8299a17906bc1cb553de33ee1b24e0fa728c15fc4beb5b802f09b774d
SHA512

f64af9de23eae4bc6a96766c894fcd638a38cfa61d257e641f56963dd477b19a47f1b8cce41ea01d9c358a8b5699d43dd2a136b20e2f351845425fae6c3e3bb9
SSDEEP

98304:l6M7mcTCIYMlJsv6tWKFdu9C/vWRnZyPPvRE:lF7nJsv6tWKFdu9C/mcRE

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4684	3956	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3956	3368	rundll32.exe	83
PID 3368 wrote to memory of 3956	3368	rundll32.exe	83
PID 3368 wrote to memory of 3956	3368	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll,#1
  2⤵
  PID:3956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 676
    3⤵
    - Program crash
    PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3956 -ip 3956
1⤵
PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads