6c48e88b559900b1627bd163f9fbe2870acf0506cc2c333e088fddf2cb653c90 | Triage

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 02:01

Sharing

Report Analysis Logs

General

Target

yuzu-windows-msvc/Qt5Qml.dll
Size

3.4MB
MD5

d055566b5168d7b1d4e307c41ce47c4b
SHA1

043c0056e9951da79ec94a66a784972532dc18ef
SHA256

30035484c81590976627f8face9507caa8581a7dc7630cccf6a8d6de65cab707
SHA512

4f12d17aa8a3008caa3ddd0e41d3ed713a24f9b5a465ee93b2e4beccf876d5bdf0259aa0d2dd77ad61bb59dc871f78937ffbe4d0f60638014e8ea8a27caf228d
SSDEEP

98304:iPnt09+kVh2NrSdSG779LLLS/o/L4YqoY0Xba+mRRH2T:iPnt2ZVhT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2540	2672	rundll32.exe	31
PID 2672 wrote to memory of 2540	2672	rundll32.exe	31
PID 2672 wrote to memory of 2540	2672	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\yuzu-windows-msvc\Qt5Qml.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2672 -s 224
  2⤵
  PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads