6c48e88b559900b1627bd163f9fbe2870acf0506cc2c333e088fddf2cb653c90 | Triage

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 02:01

Sharing

Report Analysis Logs

General

Target

yuzu-windows-msvc/Qt5WebEngineWidgets.dll
Size

244KB
MD5

e02c7bc9a4a44d4ac62ab65c56db5da0
SHA1

19e14ea13adca16b8c48609565c255361defe6ee
SHA256

2bd29d50306ac49f1df65c22e736a873f3021a0fb65f950271161a2609056e1f
SHA512

cdc0c82a5044581f70fc45c610b6c8a02c1c76c2912ff3d509a3da08dfd1f6cb4470c2319f7b7b88c596c2f7718779e66cdd12e2fff644c58a62e14e2be0ce4c
SSDEEP

6144:6qmoqgF67aYtsr/n293+r/bEpOtSx8mckEuv:6qmorM77iMv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2700	1760	rundll32.exe	30
PID 1760 wrote to memory of 2700	1760	rundll32.exe	30
PID 1760 wrote to memory of 2700	1760	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\yuzu-windows-msvc\Qt5WebEngineWidgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1760 -s 328
  2⤵
  PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-0-0x000007FEF64D0000-0x000007FEF68C8000-memory.dmp

Filesize
4.0MB

Download