91a1276b535db4a5a4629b3d917057585e4749543b442725eb579d2b06fef8cf

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 02:10

Target

Qt5Gui.dll
Size

6.2MB
MD5

056f15a4545270585122016c8c26c5a0
SHA1

20dee300da1e7c0443db037c54e0bc820824d71b
SHA256

097e21b536a4a90b35c43568ebfd4637c2f545959117f826317d362192699ada
SHA512

5465f0f19daef947213300bbdc6801ec50784c5b7dd273680b5ae5440d4a453c10a37cffd5a2a0a794c39fa47976af858e1e447cd816ecbbe1c74f5ab2ab7410
SSDEEP

98304:W4+0D7NrIK0loDTlzmb0m0VSUs9J4aaFD:H7CDH0VTWraFD

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2084	2376	rundll32.exe	30
PID 2376 wrote to memory of 2084	2376	rundll32.exe	30
PID 2376 wrote to memory of 2084	2376	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2376 -s 220
  2⤵
  PID:2084

memory/2376-2-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/2376-1-0x0000000061440000-0x000000006145A000-memory.dmp

Filesize
104KB

Download
memory/2376-3-0x000000006FC40000-0x000000006FDA5000-memory.dmp

Filesize
1.4MB

Download
memory/2376-0-0x0000000061940000-0x0000000061F7E000-memory.dmp

Filesize
6.2MB

Download
memory/2376-4-0x0000000068880000-0x0000000068EB8000-memory.dmp

Filesize
6.2MB

Download