6e84ac8d3abdfba60078a36fa7f6b492b20c2af2c502e0a4579f41367ac37c80

Analysis

max time kernel
9s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 02:50

Target

Qt5Widgets.dll
Size

5.2MB
MD5

4cd1f8fdcd617932db131c3688845ea8
SHA1

b090ed884b07d2d98747141aefd25590b8b254f9
SHA256

3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
SHA512

7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP

49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2988 wrote to memory of 2480	2988	rundll32.exe	30
PID 2988 wrote to memory of 2480	2988	rundll32.exe	30
PID 2988 wrote to memory of 2480	2988	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2988 -s 220
  2⤵
  PID:2480

memory/2988-0-0x000007FEF5E80000-0x000007FEF63C1000-memory.dmp

Filesize
5.3MB

Download