91a1276b535db4a5a4629b3d917057585e4749543b442725eb579d2b06fef8cf | Triage

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 02:10

Sharing

Report Analysis Logs

General

Target

Qt5Core.dll
Size

6.2MB
MD5

625fbb939568df156c34f0a6a5f2c8ef
SHA1

277bc2b4749e08f7429421a627b248e37ca4398e
SHA256

528b0d47ba2a60d2b857fdb8a5a74cfddeb455d1da5e058701f3d7839925035c
SHA512

0769d18829d5b6fb288156b2034ecb6634d2e53a8a2830f91a77119d2a01da64e57ffdbc355405be2a5cf17bf925c09bff24c2de393fdd751ef788a3ef2e5bdc
SSDEEP

98304:A3GOJAeNjczeOGbw7RifeZJsv6tWKFdu9CtENRnZyAo:A13Qe2Jsv6tWKFdu9CtWho

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2428	2340	rundll32.exe	31
PID 2340 wrote to memory of 2428	2340	rundll32.exe	31
PID 2340 wrote to memory of 2428	2340	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2340 -s 220
  2⤵
  PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-2-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/2340-3-0x000000006FC40000-0x000000006FDA5000-memory.dmp

Filesize
1.4MB

Download
memory/2340-1-0x0000000061440000-0x000000006145A000-memory.dmp

Filesize
104KB

Download
memory/2340-0-0x0000000068880000-0x0000000068EB8000-memory.dmp

Filesize
6.2MB

Download