199879ac19872d6b0ff820d8f502062f0efea37867b937dc04580cf170b8228d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 06:54

Target

JIGUtility_V2.0.8.0_20230112/ASUSR_ParsingRecord/ASUSR_ParsingRecord/QtCore4.dll
Size

2.5MB
MD5

8bb8ab53f24b3f37ffc8d9818a96b711
SHA1

5fadc82e34210c23095b1a96f6b5c88ac109d391
SHA256

df2f1fef45edcc147c89a71898e1ae4be0274adee81a8c9d8848b5e8be6cbbab
SHA512

766a92861d234a7a186cf8cf2fbce9fa5678425e6953b9c9c49dad5bfea6ae81101dcebcabee9afa55fd2c8a7cbd369db750c966310c4486cf4ab706e9a87cd9
SSDEEP

49152:vNt3iB8mwK6LX/DE4G3Jsv6tWKFdu9CAT/LyvL/6mShMZtmjNUVrciV5P+7QVg0M:vn3iaw3Jsv6tWKFdu9CQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	3736	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3736	2640	rundll32.exe	84
PID 2640 wrote to memory of 3736	2640	rundll32.exe	84
PID 2640 wrote to memory of 3736	2640	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JIGUtility_V2.0.8.0_20230112\ASUSR_ParsingRecord\ASUSR_ParsingRecord\QtCore4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JIGUtility_V2.0.8.0_20230112\ASUSR_ParsingRecord\ASUSR_ParsingRecord\QtCore4.dll,#1
  2⤵
  PID:3736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 648
    3⤵
    - Program crash
    PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3736 -ip 3736
1⤵
PID:3652