Analysis
-
max time kernel
92s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 14:59
General
-
Target
$_10_/Qt5Svg.dll
-
Size
284KB
-
MD5
6a447fade1154d1a5ee48c1df9170557
-
SHA1
779ad9f74bc5abf68ff2e6c0ec852953160e5fd2
-
SHA256
db2d96ae9b76d4d74d78c5ff697d66797c0b301e4e34f135b13df9cb3e6e737a
-
SHA512
6c87508592ac61b542c905e950bc3330fa829f2af844ba84ce7ac1cd2b4f94e974789bf75cb2ba1a268b30dd4f17761b8f9d0ef0eecc065b29aaadd56bb1e701
-
SSDEEP
6144:CVE742MUNi/Pkfjnbes3Mg5VB5wDiT1fBqIJfryZTqJX9cA:WE02MCi/PkfLVvBi01pvfKA
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_10_\Qt5Svg.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$_10_\Qt5Svg.dll,#12⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 7163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1428 -ip 14281⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
6.2MB
-
Filesize
316KB
-
Filesize
1.7MB
-
Filesize
572KB
-
Filesize
440KB
-
Filesize
1.8MB
-
Filesize
1.4MB
-
Filesize
240KB
-
Filesize
428KB
-
Filesize
152KB
-
Filesize
476KB
-
Filesize
484KB
-
Filesize
120KB
-
Filesize
3.5MB
-
Filesize
80KB
-
Filesize
3.5MB
-
Filesize
1.2MB
-
Filesize
5.5MB
-
Filesize
1.1MB
-
Filesize
1.8MB
-
Filesize
152KB
-
Filesize
5.5MB
-
Filesize
6.2MB