74461cd68eeb147415c70630eddeb77c7fa284a363e9f77a37654ef4bb2d4e96

Analysis

max time kernel
51s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 16:46

Target

QtNetwork4.dll
Size

1.1MB
MD5

040dd0c4b58d7860e14f313acb722087
SHA1

02fbfb5a79f64b9497453b2a4eb7587917e45066
SHA256

9c676976f4c99ac6341b5925442cfbdc63e0b5ce1c6a35d98f9cf3bde8e846eb
SHA512

291c6d4a4a883cbae0c82b1ebb043c588f83c6ad2505cf1f6b6e2cae681d2abb76089da30fb3a0d50824a62b2dc22c4ac89486328fc07f64c89a5fc0953ecb52
SSDEEP

12288:ZrPKEgt7N2DlUEM5IAHytWlG6yGBiRfb3crQL9U/j7ZcH+4NoEXN1RaE8ogx1H+7:xg7ulnM2iG6yGBiLhGjdKuEXBp8x1H

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	4068	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 4068	1512	rundll32.exe	80
PID 1512 wrote to memory of 4068	1512	rundll32.exe	80
PID 1512 wrote to memory of 4068	1512	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 672
    3⤵
    - Program crash
    PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4068 -ip 4068
1⤵
PID:3432

memory/4068-2-0x000000006E940000-0x000000006E950000-memory.dmp

Filesize
64KB

Download
memory/4068-3-0x000000006A1C0000-0x000000006A430000-memory.dmp

Filesize
2.4MB

Download
memory/4068-1-0x000000006FBC0000-0x000000006FBC7000-memory.dmp

Filesize
28KB

Download
memory/4068-0-0x000000006FF00000-0x000000007001E000-memory.dmp

Filesize
1.1MB

Download