493340b6a7247b62c120c17cebec7b9d6027ab56ec4abf809257068311bad309 | Triage

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 18:55

Sharing

Report Analysis Logs

General

Target

Qt5Svg.dll
Size

331KB
MD5

a2368bffaacd4f99dbeb828b78c20bc1
SHA1

33511e80f5e918bcb1df41e9011613e356d929d5
SHA256

cb344b0fa25f8e1b4057e1848c45266bc69f1dab9c5ecd71ecd5d5bc38ddef93
SHA512

be56834f3ea660cd220f7143b246c46d631104fc836fa606a3cdcf78e79a66fbf36a01cc45d830afec299fac7d515d7ff78836acf94b67f2761006dc96eb6f00
SSDEEP

6144:fznt6nKOHBm+RyXyRTlL0hq+S3p/oGr9YpV/T:bnAaXyRy

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2008 wrote to memory of 1628	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1628	2008	rundll32.exe	WerFault.exe
PID 2008 wrote to memory of 1628	2008	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Svg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2008 -s 216
  2⤵
  PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-0-0x000007FEF61B0000-0x000007FEF66FD000-memory.dmp

Filesize
5.3MB

Download