6e84ac8d3abdfba60078a36fa7f6b492b20c2af2c502e0a4579f41367ac37c80 | Triage

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 02:50

Sharing

Report Analysis Logs

General

Target

Qt5Sql.dll
Size

203KB
MD5

ccfddf94281ffad70ee2d26bb77f8b1c
SHA1

6861a4b16ac5ab05ff594e50d8d63579dab1d969
SHA256

9ca14f8d46c25c7c5be2ffbd070231859906204a775e8b8b3f762630efd5f721
SHA512

4bd2d0ba6e3cef76de2a0e09d8ad1b27c8d00e55744ec25f37bef1e4e5e8723468054d1b8c719ab2318bdda342639447f138995a9be22fd8c5af71eece953bb2
SSDEEP

3072:sdByij0ih9GM4lttKrjH1Nhpdw8yDsdKB6Jxy/UaUn+hV:+ByionMKEpdSsNxyMaUn8V

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2224 wrote to memory of 2392	2224	rundll32.exe	WerFault.exe
PID 2224 wrote to memory of 2392	2224	rundll32.exe	WerFault.exe
PID 2224 wrote to memory of 2392	2224	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Sql.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2224 -s 212
  2⤵
  PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads