3da2156d209fd99a785ccfa240045330f558a43462c963c25723ffbd08ab5aab | Triage

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 10:44

Sharing

Report Analysis Logs

General

Target

QtNetwork4.dll
Size

1.1MB
MD5

8cf69338715127f9c1fffd8f622c0686
SHA1

7b9bd00d0e369fac33178fe0eb0d19619ef4ee29
SHA256

eb50bfc6630a7e0ac6ba1557ba87b423b52f784c4da1c0f5dc1f25cdd7769039
SHA512

b3bf1bb99dd031c6839ee61299f7d2b978cc40364fcd1dc80aa4ece60d3d0f3d88c86821510cb9d16cbac46bff8f7e36652f2753cfc2b4b3ec8fe9ac44834504
SSDEEP

24576:gXh0rksqO40lyRPTrYosLa8Nq1grcdQdcJvSn+kN0upzi:gm5qO4x5p1xG0A

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2948	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2948	1336	rundll32.exe	31
PID 1336 wrote to memory of 2948	1336	rundll32.exe	31
PID 1336 wrote to memory of 2948	1336	rundll32.exe	31
PID 1336 wrote to memory of 2948	1336	rundll32.exe	31
PID 1336 wrote to memory of 2948	1336	rundll32.exe	31
PID 1336 wrote to memory of 2948	1336	rundll32.exe	31
PID 1336 wrote to memory of 2948	1336	rundll32.exe	31
PID 2948 wrote to memory of 2996	2948	rundll32.exe	32
PID 2948 wrote to memory of 2996	2948	rundll32.exe	32
PID 2948 wrote to memory of 2996	2948	rundll32.exe	32
PID 2948 wrote to memory of 2996	2948	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QtNetwork4.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 256
    3⤵
    - Program crash
    PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-0-0x000000006FF00000-0x0000000070020000-memory.dmp

Filesize
1.1MB

Download
memory/2948-3-0x000000006A1C0000-0x000000006A414000-memory.dmp

Filesize
2.3MB

Download
memory/2948-2-0x000000006E940000-0x000000006E950000-memory.dmp

Filesize
64KB

Download
memory/2948-1-0x000000006FBC0000-0x000000006FBC7000-memory.dmp

Filesize
28KB

Download