74461cd68eeb147415c70630eddeb77c7fa284a363e9f77a37654ef4bb2d4e96 | Triage

Analysis

max time kernel
139s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 16:46

Sharing

Report Analysis Logs

General

Target

QtWebKit4.dll
Size

16.5MB
MD5

849b9a4c0940627149a5440d81c40d0d
SHA1

832d38b8f148e521610c5e9f6ab585cd7c26a0d8
SHA256

596293cd31bbced5513846a1237bd98fcbd88be8c9097514b1f2ced127f182cd
SHA512

d08216021677b3f7b0384c19ae220232f099771c824c257ec13b1c63fa14e83f7679ab607a36538cdd805da1dcb8038099e05afe1aa9fa7200b2a74d84569237
SSDEEP

393216:9/KY1Ury4eAwWa+Gy9ojp7xsNZaG1NdD6PiaR:9SDwWa+GCtCGtD66aR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 5080	1840	rundll32.exe	87
PID 1840 wrote to memory of 5080	1840	rundll32.exe	87
PID 1840 wrote to memory of 5080	1840	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtWebKit4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtWebKit4.dll,#1
  2⤵
  PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5080-0-0x0000000000A00000-0x0000000000B1E000-memory.dmp

Filesize
1.1MB

Download