ef483723ac88d655dfc5f08537cbc7ca6bef3ca2c2f34fd1ade321156f4efe08 | Triage

Analysis

max time kernel
1556s
max time network
1558s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 13:52

Sharing

Report Analysis Logs

General

Target

ZRK 1.1 UC/src/PyQt5/Qt5/bin/Qt5Qml.dll
Size

3.4MB
MD5

d055566b5168d7b1d4e307c41ce47c4b
SHA1

043c0056e9951da79ec94a66a784972532dc18ef
SHA256

30035484c81590976627f8face9507caa8581a7dc7630cccf6a8d6de65cab707
SHA512

4f12d17aa8a3008caa3ddd0e41d3ed713a24f9b5a465ee93b2e4beccf876d5bdf0259aa0d2dd77ad61bb59dc871f78937ffbe4d0f60638014e8ea8a27caf228d
SSDEEP

98304:iPnt09+kVh2NrSdSG779LLLS/o/L4YqoY0Xba+mRRH2T:iPnt2ZVhT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1992	2684	rundll32.exe	30
PID 2684 wrote to memory of 1992	2684	rundll32.exe	30
PID 2684 wrote to memory of 1992	2684	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ZRK 1.1 UC\src\PyQt5\Qt5\bin\Qt5Qml.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2684 -s 224
  2⤵
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads