6e84ac8d3abdfba60078a36fa7f6b492b20c2af2c502e0a4579f41367ac37c80 | Triage

Analysis

max time kernel
14s
max time network
22s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 02:50

Sharing

Report Analysis Logs

General

Target

Qt5ScriptTools.dll
Size

555KB
MD5

dd9fecbf34374972577a058e5a4c7c3d
SHA1

16c3114a75a2eced0104428dc779a3dbda951cc0
SHA256

ad25c27bc99075b4883a9bf7943954094885798969038d46785e0fd1ec1ccbc2
SHA512

8aeeca34b63930564d42056ca1b7d3c59d6fe017b19e86fb294fafab982a014b09bbc40f32a9cc5d36c8afa13d7863ba4f144ab6a4af465acbc8a6a72f6d8554
SSDEEP

12288:HnZlvw+mZfMDFfRRLLUTF5xQFa3J5cbQ0:HnZlvw+mVmFfRRLLYFHQF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2300 wrote to memory of 380	2300	rundll32.exe	WerFault.exe
PID 2300 wrote to memory of 380	2300	rundll32.exe	WerFault.exe
PID 2300 wrote to memory of 380	2300	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5ScriptTools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2300 -s 216
  2⤵
  PID:380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-0-0x000007FEF56C0000-0x000007FEF5C01000-memory.dmp

Filesize
5.3MB

Download