7c5b449226d2c3e8e65341baffb10b9393282d53b7f6fb164ed788ca2967bb99

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 23:59

Target

bin/Qt5Gui.dll
Size

9.2MB
MD5

fc7d92feb89f055f7f19169e7a1f3621
SHA1

5a0f1b5fa82f419020fb38010340032971495dcd
SHA256

8bcf807aaf2419843a778994187fa4a2fe9e2d926435ed8add3e670935b3f9aa
SHA512

e97dbc3afc7875dd753c10804aa1c98abc6462f4a295ef88f9f96292a620d607f8d67fb3172a4eca72664f7c0e928e2709dfff42586f516c4ba3567fa4a334e0
SSDEEP

98304:4jXCr0pPxu7Ve0VW0I4UZYS437MU1MXUDyfK:Oyr0pv0VW0qYDLMUX

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2092 wrote to memory of 2408	2092	rundll32.exe	WerFault.exe
PID 2092 wrote to memory of 2408	2092	rundll32.exe	WerFault.exe
PID 2092 wrote to memory of 2408	2092	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\Qt5Gui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2092 -s 228
2⤵
PID:2408

memory/2092-0-0x0000000061940000-0x0000000062012000-memory.dmp

Filesize
6.8MB

Download
memory/2092-4-0x000007FEF5F30000-0x000007FEF6183000-memory.dmp

Filesize
2.3MB

Download
memory/2092-3-0x000007FEFB720000-0x000007FEFB736000-memory.dmp

Filesize
88KB

Download
memory/2092-5-0x0000000068880000-0x0000000068EB9000-memory.dmp

Filesize
6.2MB

Download
memory/2092-1-0x0000000061940000-0x0000000062012000-memory.dmp

Filesize
6.8MB

Download
memory/2092-2-0x000007FEF7650000-0x000007FEF767C000-memory.dmp

Filesize
176KB

Download