3009532e98aa81d46345bd85e5b3ddb8f24ff9c538ae64aafbd5aafd8cb01dea

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 01:18

Target

Qt5Widgets.dll
Size

4.1MB
MD5

da9d27ff42f875d3803d20ab7d725b8f
SHA1

df9578285ffde620a260693567e972f1b1b32436
SHA256

4dd313ccaf0c6fe70b3c06d7350cb2ece59840d5c0fcfc91bb0842e2f64876c1
SHA512

1ffe5deba23bce9b4a78f3509441653692641c584ab8a765ef64ff57d9fd70985c5a050667af0f31dfe4adbc1cd4d7aa582ca2aa60a01d8fc91556da9fa7b49f
SSDEEP

24576:G6HNX+SaobmDAwmlhIB45JprYXFafATw93FKInnhTV8jF2IYJGlCrQORBFujN4Rq:x7bnOFlgQ0uJiphwWO10VmVsPBp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3996	1236	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1236	3140	rundll32.exe	84
PID 3140 wrote to memory of 1236	3140	rundll32.exe	84
PID 3140 wrote to memory of 1236	3140	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll,#1
  2⤵
  PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 744
    3⤵
    - Program crash
    PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1236 -ip 1236
1⤵
PID:3100