88feaa6acdfd75de35b39c26b4f772f9f136ec0b9db74a3c7f4045653bda463b

Analysis

max time kernel
147s
max time network
277s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
09/07/2024, 02:14

Target

ExitLag/Qt5WinExtras.dll
Size

197KB
MD5

87c5dfc5b38eccd303abc7880fa92123
SHA1

aabd6e39defd9aed5986f90c079869df9a977306
SHA256

3db3e1e9a3bda8302aa6f177591feca2e04dc9a336459a25f160c3105c9a03fb
SHA512

9a536d69ed7ae83825b87960c710507e117694e7fc2867675be982e047094cfa5d2efd4fcbd6704606f6cf12c1fd745661dc9824d05eae7fd83c3aa6d49b3770
SSDEEP

3072:W7B3LXHsaM6URaWba7e6NZtFC2Hvhductw+aZXoxtqXGeot+e:WtTsP6URaURQZjCcvVtw+aZXwwre

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3436	3336	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 3336	3544	rundll32.exe	83
PID 3544 wrote to memory of 3336	3544	rundll32.exe	83
PID 3544 wrote to memory of 3336	3544	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\Qt5WinExtras.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExitLag\Qt5WinExtras.dll,#1
  2⤵
  PID:3336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 704
    3⤵
    - Program crash
    PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3336 -ip 3336
1⤵
PID:3488