3009532e98aa81d46345bd85e5b3ddb8f24ff9c538ae64aafbd5aafd8cb01dea

Analysis

max time kernel
96s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 01:18

Target

Qt5Gui.dll
Size

2.8MB
MD5

2e6e0d37b7876af3df53571d89d69dea
SHA1

5923daf1090aaa59f5289296381c2ea0144d9046
SHA256

5d1ff382f950deb2017dc981cdc11cff15c18caa4ebf274070adeb44e6e9aa73
SHA512

22f76c0aa8d8a65740e8313e447ad36b65d10ed4919f386a66901455b78d05596f8cb2a2477063440c2be8e3ad1ad19cd48af0e026558b67c4419694340f3390
SSDEEP

24576:aJ0hif8Ie6ufVgt7Baa440CqTdNu7VOzehw1ARLlbMK9ovxoR55DgRhz0nBE7nG/:I0BVBan0CqTMBhw5fXz6EuVMR7XEXeY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	3940	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3940	3672	rundll32.exe	81
PID 3672 wrote to memory of 3940	3672	rundll32.exe	81
PID 3672 wrote to memory of 3940	3672	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Gui.dll,#1
  2⤵
  PID:3940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 744
    3⤵
    - Program crash
    PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3940 -ip 3940
1⤵
PID:2644