5f20af1d782468507417d0785826b1f064fadba88ed1691e2def269922ace56b

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 23:14

Target

Qt5Gui.dll
Size

4.5MB
MD5

23439958cd89baa6970c1aac9060af2b
SHA1

522bad44bd28149e62ff7ec45b38bb8cfca8c0e5
SHA256

b8e72ec747f1f056f07536446934ee0606525f0eccdcae78966e6097e4d577e5
SHA512

3d909214e74f7ed718688b0e2b7f86319bfbe20a902c4f127f2f3a7e25b2bd781a62afd30eaa07bbbcd87d9ff03f05b053a6e63c007bbc89790cfcd97dac5638
SSDEEP

49152:qR7gxfIqqH22A9pcoNHWh2EZf2KucPtchYTesGY2XtHM0r8+YtjY1hCKyO3la40r:qdoNoDucPKmTmY+Qy3la4m/tGc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 780	1952	rundll32.exe	30
PID 1952 wrote to memory of 780	1952	rundll32.exe	30
PID 1952 wrote to memory of 780	1952	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1952 -s 200
  2⤵
  PID:780

memory/1952-0-0x0000000001E30000-0x000000000234B000-memory.dmp

Filesize
5.1MB

Download
memory/1952-3-0x0000000062E80000-0x0000000062EA4000-memory.dmp

Filesize
144KB

Download
memory/1952-4-0x0000000068B40000-0x0000000068C5D000-memory.dmp

Filesize
1.1MB

Download
memory/1952-1-0x0000000066780000-0x0000000066C12000-memory.dmp

Filesize
4.6MB

Download
memory/1952-2-0x0000000001E30000-0x000000000234B000-memory.dmp

Filesize
5.1MB

Download