0ee6265fb360ff4f06ac38b3f69689d3e74889a8ed9f92c2cb21a90e9efb2263 | Triage

Resubmissions

29-11-2024 14:08

241129-rfpqlazjg1 10

29-11-2024 14:03

241129-rcyjbsyrd1 10

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 14:08

Sharing

Report Analysis Logs

General

Target

lib/Qt5Concurrent.dll
Size

128KB
MD5

31955f92dd3ca70cab821b6199018ebf
SHA1

3177661f6e066460f2c859d2d5453323b68d6eda
SHA256

d4a01961fff02cc38ab906d3bffaeb49db893edc624f840e06d07985086db29f
SHA512

ec5b65741685882008769abd68fb88cf12c58b0b9d76f0a6326f352ee7a78cc4567473c50e9abe12fd8af0c06bb1ae9840ee0d5f78024580aaaf1c34e0b14504
SSDEEP

3072:3Q8Eh7XgsZxlePu00k7hkNKSBMU+m3EkbnW6//V:3rg7wmePu01CXrUkV

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2352 wrote to memory of 1880	2352	rundll32.exe	31
PID 2352 wrote to memory of 1880	2352	rundll32.exe	31
PID 2352 wrote to memory of 1880	2352	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\Qt5Concurrent.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2352 -s 84
  2⤵
  PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads