493340b6a7247b62c120c17cebec7b9d6027ab56ec4abf809257068311bad309

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 18:55

Target

Qt5Widgets.dll
Size

5.3MB
MD5

7413e00bfa048e1c8c99e8a45a771092
SHA1

5f59a856e1f678778f09f35b87f02bedbdada03d
SHA256

e28758fe46c69b462b0505aa339a6870865bacd121f14ecec04be0d8c9156210
SHA512

bf6dabe960f67a6d18f95b93dc839aeaafe8c38994dcb859e4729f77001a3109a694bf1e1d06c04982bcc0f5b7b88131b23b86f49642d66bd895ee8101aae86e
SSDEEP

49152:REeDF4qZrQShJQpr/dgJoLIIIagZKuvIOxvxUHWzR+Ve93unCV9Vzshqy1jMuRfY:F5n7uLI1xSAVbshqy1jMuR74iKjrtTzJ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2724 wrote to memory of 2704	2724	rundll32.exe	WerFault.exe
PID 2724 wrote to memory of 2704	2724	rundll32.exe	WerFault.exe
PID 2724 wrote to memory of 2704	2724	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2724 -s 216
  2⤵
  PID:2704

memory/2724-0-0x000007FEF4DD0000-0x000007FEF531D000-memory.dmp

Filesize
5.3MB

Download