5f20af1d782468507417d0785826b1f064fadba88ed1691e2def269922ace56b | Triage

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 21:43

Sharing

Report Analysis Logs

General

Target

Qt5Core.dll
Size

5.1MB
MD5

b1f30ccbb0d01071d9af4ec6eb85a3b3
SHA1

691146c9430c96d789fd2955a2c65b820a9202f9
SHA256

64d345fe6b73c2f249164c6494074c0393d7ee45388c562d57aef9708a1f3c26
SHA512

61388eb4253b3b04ccea2b57062936c0b17fb83122639435c40f03458beec7ab652486e1f0e402c405b867505d6f8928a83ab848e1d2ce3e1708e9d88881fb3a
SSDEEP

98304:+v/RNsL12fxXz+NIVnB2H0SorJsv6tWKFdu9CpllQ:gWI4mncOrJsv6tWKFdu9Cp/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 276 wrote to memory of 2564	276	rundll32.exe	29
PID 276 wrote to memory of 2564	276	rundll32.exe	29
PID 276 wrote to memory of 2564	276	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 276 -s 176
  2⤵
  PID:2564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-1-0x0000000062E80000-0x0000000062EA4000-memory.dmp

Filesize
144KB

Download
memory/276-0-0x0000000066740000-0x0000000066C5B000-memory.dmp

Filesize
5.1MB

Download