77763018072adb9e864f06deac9ae588a7ec4ea1a112f9f82c6201d5b7973e84

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 08:30

Target

QtNetwork4.dll
Size

651KB
MD5

b91ab2d92027947dcc85bf5563433780
SHA1

8cdb199ad9aa49cf03d01b32070d30a706cd9f07
SHA256

2e9bf6a27bcfa809caac1eef94fb815faa35f3e51cdf97fe35a95517ea6b4783
SHA512

73dd51f891763eb7a45f908906946f90aa629bbebe84c0b3df89f1668f926a5e88d4a9b19b9780211948ff673d4ef8abcb869a4ebceb75ed01b2abe6a43ba2a2
SSDEEP

12288:uS41O8YIQnN02EJPnNCH47CeF09n2y8cxxaCwqaymT3D/QYzAgMq0dSgGqMisL2D:u6N02EkSD/TMq0dSgGqM3U

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1264	2200	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2200	1796	rundll32.exe	28
PID 1796 wrote to memory of 2200	1796	rundll32.exe	28
PID 1796 wrote to memory of 2200	1796	rundll32.exe	28
PID 1796 wrote to memory of 2200	1796	rundll32.exe	28
PID 1796 wrote to memory of 2200	1796	rundll32.exe	28
PID 1796 wrote to memory of 2200	1796	rundll32.exe	28
PID 1796 wrote to memory of 2200	1796	rundll32.exe	28
PID 2200 wrote to memory of 1264	2200	rundll32.exe	29
PID 2200 wrote to memory of 1264	2200	rundll32.exe	29
PID 2200 wrote to memory of 1264	2200	rundll32.exe	29
PID 2200 wrote to memory of 1264	2200	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 248
    3⤵
    - Program crash
    PID:1264