493340b6a7247b62c120c17cebec7b9d6027ab56ec4abf809257068311bad309 | Triage

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 18:55

Sharing

Report Analysis Logs

General

Target

Qt5Network.dll
Size

1.2MB
MD5

b4acf75809acaf64168561f8d9b61a58
SHA1

d7ece8b6b9448bf886014f228f6c3c2577be6000
SHA256

cb3701d4dc1010b0a89c7ce06f1cdc2febc484b570ab35897836bfdc94099aee
SHA512

1f75e5a420e986ac52c469f0e39d4bbbdd9e0103796b285823257b3c1f5d9ee90d4965f0bfc036dabf01e8b1ce4865df7338a66e7a7aa094f43ef2bc89646fe3
SSDEEP

24576:mnfZi5GWtlkUJXMD4muWb1FhdQZD72SE2bx0/QVpBO:IiEWtqURMD4jWb5MQW0/QRO

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2252 wrote to memory of 2532	2252	rundll32.exe	WerFault.exe
PID 2252 wrote to memory of 2532	2252	rundll32.exe	WerFault.exe
PID 2252 wrote to memory of 2532	2252	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Network.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2252 -s 248
  2⤵
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads