6a1bdfae4f1a8518dabad69c758c063e36298151a4f8c9b5ce0d7fedceafaf53

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 21:04

Target

QtXmlPatterns4.dll
Size

3.8MB
MD5

edd5413016d7b1406f2d779cd365194f
SHA1

46ddbe501b9933ab9a26648575a647b50babb3d8
SHA256

03b69dc409a07b4c281838acd0ceedacc10d69e35fd6ddc8b0e9ccf480e07cbe
SHA512

58d08ad5ddc5ff501bec1f933311a5643b72b38fb2b859f31d7f4cb5c1d79a5959fa51ab229dfc835f652d4cebad8b101ca0cd6e56a8c294e53d6bfbf40ef7c7
SSDEEP

98304:6FZ5+2spJJAHE312AYR555+cX5nd95FIGIvbR7WSzYOf2VlHICeniD2NLSJenSSE:6J+F74P55ZJnd95yGAl7dYO++mSFO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
632	3044	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 3044	4324	rundll32.exe	83
PID 4324 wrote to memory of 3044	4324	rundll32.exe	83
PID 4324 wrote to memory of 3044	4324	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtXmlPatterns4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtXmlPatterns4.dll,#1
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 684
    3⤵
    - Program crash
    PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3044 -ip 3044
1⤵
PID:376

memory/3044-2-0x000000006E940000-0x000000006E950000-memory.dmp

Filesize
64KB

Download
memory/3044-3-0x000000006FF00000-0x000000007002E000-memory.dmp

Filesize
1.2MB

Download
memory/3044-0-0x0000000070DC0000-0x0000000071199000-memory.dmp

Filesize
3.8MB

Download
memory/3044-1-0x000000006FBC0000-0x000000006FBC7000-memory.dmp

Filesize
28KB

Download
memory/3044-4-0x000000006A1C0000-0x000000006A434000-memory.dmp

Filesize
2.5MB

Download