3f4b288335a86c908e015d254715d6fb9838f729e13aa3c06e53792ddaf59cad | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 08:56

Sharing

Report Analysis Logs

General

Target

Sample/Qt5Widgets.dll
Size

5.3MB
MD5

c502bb8a4a7dc3724ab09292cd3c70d6
SHA1

ff44fddeec2d335ec0eaa861714b561f899675fd
SHA256

4266918226c680789d49cf2407a7fec012b0ed872adafb84c7719e645f9b2e6d
SHA512

73bef89503ce032fba278876b7dab9eac275632df7a72c77093d433c932272da997e8fbeb431a09d84baac7b2ab2e55222ff687893311949a5603e738bfa6617
SSDEEP

98304:oSIq7lPpagrGUtPm3qBF+1jIJJAi+eVq8:oSI8hagrGUtPm3KMRIL+e/

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2976 wrote to memory of 2344	2976	rundll32.exe	30
PID 2976 wrote to memory of 2344	2976	rundll32.exe	30
PID 2976 wrote to memory of 2344	2976	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Sample\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2976 -s 208
  2⤵
  PID:2344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-0-0x000007FEF5C20000-0x000007FEF616E000-memory.dmp

Filesize
5.3MB

Download