5f20af1d782468507417d0785826b1f064fadba88ed1691e2def269922ace56b | Triage

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 21:43

Sharing

Report Analysis Logs

General

Target

Qt5Xml.dll
Size

361KB
MD5

790afb9ad63350fe327cbe409c08f01a
SHA1

652b7d29dcbd633282de7c2a6d39a0e718a4bb1c
SHA256

3864e3649485fb23d12f01e968a19f7ce0eff987c02e74e602c0b5527f92912d
SHA512

084f44583fc16c00126ed4ae340fa041b9ebaccb4e041dce73da66c6ccfc4be726cde486f199c056e3e3342db87314407af392f33d9efdd29adb15974b2c785a
SSDEEP

6144:5rPIKhCmvlwVuZa+hrctIWFXKxpFE0CqwHGYkC/S6C+/0UPiCTmRsU:5rAKhpvlwVuZa+hrctIWFXKxfCqwYC/L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1684	1080	rundll32.exe	30
PID 1080 wrote to memory of 1684	1080	rundll32.exe	30
PID 1080 wrote to memory of 1684	1080	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Xml.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1080 -s 180
  2⤵
  PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-0-0x0000000068540000-0x00000000685A2000-memory.dmp

Filesize
392KB

Download
memory/1080-2-0x0000000062E80000-0x0000000062EA4000-memory.dmp

Filesize
144KB

Download
memory/1080-1-0x0000000066740000-0x0000000066C5B000-memory.dmp

Filesize
5.1MB

Download