b06842757fdca6faf5f5509093fc50ee620e0f183882438221e27acae4d9e33f | Triage

Analysis

max time kernel
51s
max time network
17s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 08:38

Sharing

Report Analysis Logs

General

Target

Qt5Widgets.dll
Size

4.3MB
MD5

b2b002c566edabcc6be3ee449699e707
SHA1

d80645cdf0be47b2f4eff58a6a474b81177cd112
SHA256

535c0b78c757fe6f11c4369b5b6993a3dd850b0269e4d0d2d0e5bf24d933f29b
SHA512

33eeaca82949103960b7d141d4e20414c399f385b5d7f7589b21362eaad0b6fd28beec224b1654c420ff38a78f3cec2fd72926af872ec01acfcdbbf56f853525
SSDEEP

49152:B5PJKhgOVwTngFLmM4GDVdGOZd31nvXhUjJKtjc1k374FG:BygO8ehvq2cFG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2784 2436 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2276 wrote to memory of 2436	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 2436	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 2436	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 2436	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 2436	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 2436	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 2436	2276	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 2784	2436	rundll32.exe	WerFault.exe
PID 2436 wrote to memory of 2784	2436	rundll32.exe	WerFault.exe
PID 2436 wrote to memory of 2784	2436	rundll32.exe	WerFault.exe
PID 2436 wrote to memory of 2784	2436	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 248
3⤵
- Program crash
PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads