499ce7e26fd7b500c1e05570bc2266053862c18c5b37c2f72f5ad99a2e32149a | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 09:23

Sharing

Report Analysis Logs

General

Target

Qt5NetworkR.dll
Size

1.0MB
MD5

ec63e27340077b40d0e4493bdeb45fa2
SHA1

b918117212af989185f09f55a27b2c1403de010e
SHA256

69132bcc4a4fc573f35ccf6c2bd1fa2b0ce2850279dd4e33b22b4bfe2783cc53
SHA512

617b62ec69e891b8f2405f8017f896947e2d4560a385eb3b7de92b3b9e3ff1fc97ce7c8a9f06682efd9e4ab85a2d037e6fb491fc56c3701996e4ca3aa1b1d9a6
SSDEEP

24576:pK89xVessyVWJDd03caWKBr6DRCkslE+s:rxV3syVeS3fZBr/kslL

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2308	2392	rundll32.exe	31
PID 2392 wrote to memory of 2308	2392	rundll32.exe	31
PID 2392 wrote to memory of 2308	2392	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5NetworkR.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2392 -s 224
  2⤵
  PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads