6e84ac8d3abdfba60078a36fa7f6b492b20c2af2c502e0a4579f41367ac37c80 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 02:50

Sharing

Report Analysis Logs

General

Target

Qt5Svg.dll
Size

322KB
MD5

03761f923e52a7269a6e3a7452f6be93
SHA1

2ce53c424336bcc8047e10fa79ce9bce14059c50
SHA256

7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
SHA512

de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
SSDEEP

6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2568 wrote to memory of 2380	2568	rundll32.exe	30
PID 2568 wrote to memory of 2380	2568	rundll32.exe	30
PID 2568 wrote to memory of 2380	2568	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Svg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2568 -s 216
  2⤵
  PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2568-0-0x000007FEF67E0000-0x000007FEF6D21000-memory.dmp

Filesize
5.3MB

Download