77763018072adb9e864f06deac9ae588a7ec4ea1a112f9f82c6201d5b7973e84

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 08:30

Target

QtNetwork4.dll
Size

651KB
MD5

b91ab2d92027947dcc85bf5563433780
SHA1

8cdb199ad9aa49cf03d01b32070d30a706cd9f07
SHA256

2e9bf6a27bcfa809caac1eef94fb815faa35f3e51cdf97fe35a95517ea6b4783
SHA512

73dd51f891763eb7a45f908906946f90aa629bbebe84c0b3df89f1668f926a5e88d4a9b19b9780211948ff673d4ef8abcb869a4ebceb75ed01b2abe6a43ba2a2
SSDEEP

12288:uS41O8YIQnN02EJPnNCH47CeF09n2y8cxxaCwqaymT3D/QYzAgMq0dSgGqMisL2D:u6N02EkSD/TMq0dSgGqM3U

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1224	4956	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 4956	1616	rundll32.exe	84
PID 1616 wrote to memory of 4956	1616	rundll32.exe	84
PID 1616 wrote to memory of 4956	1616	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
  2⤵
  PID:4956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 668
    3⤵
    - Program crash
    PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4956 -ip 4956
1⤵
PID:3184