499ce7e26fd7b500c1e05570bc2266053862c18c5b37c2f72f5ad99a2e32149a

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 09:23

Target

Qt5WidgetsR.dll
Size

5.3MB
MD5

87db4db37341bc674aa2f41231b2ae1d
SHA1

e3dd51fd0b5ac7109e0af4cb566b8e34222a0dc8
SHA256

efb86a833e7ace8c3856eddf474369f991c8cb136a03527a46b7b20a73ef2ad5
SHA512

6db10de2859a300496abebba63352191f472606d2b90f78313859be5555a8ffdf0f6a25a250156a109d58009f3442ee6278901e8580590ff7cd178c4b39df653
SSDEEP

49152:wdDURQxkgCixNmdSBTES/qoHEyTM/3WWpxBfN8RmuiHnYQxkyuYcqTLPK3p1z4MD:mRzCmkT75qxqTLPK3p1zeZ3Hh

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2532	1764	rundll32.exe	31
PID 1764 wrote to memory of 2532	1764	rundll32.exe	31
PID 1764 wrote to memory of 2532	1764	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5WidgetsR.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1764 -s 248
  2⤵
  PID:2532

memory/1764-0-0x000007FEF5760000-0x000007FEF5CB3000-memory.dmp

Filesize
5.3MB

Download