7b789067fc92947c089c7bd54324742156f04d7a2d670de4e5170c87abf72f3d

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/12/2024, 23:42

Target

_internal/PyQt5/Qt5/bin/Qt5Designer.dll
Size

4.3MB
MD5

c4351384c469750009e5464dd773019a
SHA1

9f114bac87af2e0598790cf3298ca7bdfafdfe21
SHA256

807e2b399048bc482e1a96f10669387f5f27542ca1b1d8dbcbaeabe53055752a
SHA512

6199af25e0224b7288d4b84b9677bad7cffce64f6bcd7b46817823887f94894fa764e1fb31eb300b5f1afc64ccf433e71db2ed28044f2001cc1715cb20433944
SSDEEP

98304:wriDM0a/9ul3ttbU/pQP2xlEeOCGfmcQWmvHWd/52/:wriDM0a/9ul3ttbcQOx4CUmcQWmvGU/

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2160	3008	rundll32.exe	31
PID 3008 wrote to memory of 2160	3008	rundll32.exe	31
PID 3008 wrote to memory of 2160	3008	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_internal\PyQt5\Qt5\bin\Qt5Designer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3008 -s 216
  2⤵
  PID:2160

memory/3008-0-0x000007FEF5A50000-0x000007FEF5F91000-memory.dmp

Filesize
5.3MB

Download
memory/3008-1-0x000007FEF5FA0000-0x000007FEF63EB000-memory.dmp

Filesize
4.3MB

Download