b06842757fdca6faf5f5509093fc50ee620e0f183882438221e27acae4d9e33f | Triage

Analysis

max time kernel
32s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12-06-2024 08:38

Sharing

Report Analysis Logs

General

Target

Qt5Widgets.dll
Size

4.3MB
MD5

b2b002c566edabcc6be3ee449699e707
SHA1

d80645cdf0be47b2f4eff58a6a474b81177cd112
SHA256

535c0b78c757fe6f11c4369b5b6993a3dd850b0269e4d0d2d0e5bf24d933f29b
SHA512

33eeaca82949103960b7d141d4e20414c399f385b5d7f7589b21362eaad0b6fd28beec224b1654c420ff38a78f3cec2fd72926af872ec01acfcdbbf56f853525
SSDEEP

49152:B5PJKhgOVwTngFLmM4GDVdGOZd31nvXhUjJKtjc1k374FG:BygO8ehvq2cFG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3256 3700 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 316 wrote to memory of 3700	316	rundll32.exe	rundll32.exe
PID 316 wrote to memory of 3700	316	rundll32.exe	rundll32.exe
PID 316 wrote to memory of 3700	316	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll,#1
2⤵
PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 684
3⤵
- Program crash
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3700 -ip 3700
1⤵
PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...