88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
91s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2024, 02:14

Target

ExitLag/Qt5Xml.dll
Size

170KB
MD5

bb54f9d38190c53e933da90b01d2d506
SHA1

137f53a8dea540bf9a276b4cc78ea7a76e23b110
SHA256

d1de30f5e7247b0a945839028e78d8e91c79b234da33735466040ccb9deddb44
SHA512

696b7a0f62017d47ff9a6fc0061a5dfab8f5d90b089c5f4c05fc6384d8c57bec5200e34d939428fa83cf477f4720b417dbe82d585a50808d1f6417973deb5b50
SSDEEP

3072:beRKwkG/gFi66ws/FDC5JaBFJtx5dzSQCvUGRNueNSY4IJ32fLLyUAxGMWdE/S9+:9wkLFi66tDCv7uYJ4IJ32fKGMWdBI7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5084	2116	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 2116	432	rundll32.exe	83
PID 432 wrote to memory of 2116	432	rundll32.exe	83
PID 432 wrote to memory of 2116	432	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\Qt5Xml.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\Qt5Xml.dll,#1
  2⤵
  PID:2116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 676
    3⤵
    - Program crash
    PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2116 -ip 2116
1⤵
PID:2392