7b789067fc92947c089c7bd54324742156f04d7a2d670de4e5170c87abf72f3d

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/12/2024, 23:42

Target

_internal/PyQt5/Qt5/bin/Qt5Help.dll
Size

418KB
MD5

6faab9f54169b33f970a2ce0ae8ead06
SHA1

0ee3071737827204feb6fdaeb5a4a9a01eb43ec0
SHA256

e976997b615403842437e46053412fe571377443631d7bec99ff5c2c7e00a5cc
SHA512

d35a3e41c68b160c8e475a04888ba9397f029e4a091335ed7080ee917b70a42f0cbe9161b16a27c37e730701936798c2e195e3921b6dae13b838b41617e932d2
SSDEEP

6144:W5OU+lG3LViV3hMkkAGdFxBsVn3uhIb4kW4XJjnK2xKDgpywUoVXqXrarUPtGBf2:W5OEViVRMpAv3uh+4kzKmKafzu6g

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2040	2552	rundll32.exe	30
PID 2552 wrote to memory of 2040	2552	rundll32.exe	30
PID 2552 wrote to memory of 2040	2552	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_internal\PyQt5\Qt5\bin\Qt5Help.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2552 -s 216
  2⤵
  PID:2040

memory/2552-0-0x000007FEF5E10000-0x000007FEF6351000-memory.dmp

Filesize
5.3MB

Download