7b789067fc92947c089c7bd54324742156f04d7a2d670de4e5170c87abf72f3d | Triage

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/12/2024, 23:42

Sharing

Report Analysis Logs

General

Target

_internal/PyQt5/Qt5/bin/Qt5Location.dll
Size

1.6MB
MD5

3e8f0d7a97856a7a4fab71ce11d0c46e
SHA1

2402efd8e996dd45f10a42f6d0d5dba9427d9d57
SHA256

e25d5470ebf057743e9a427358aa1f13b661442eddbd695d20ac421a97e19a40
SHA512

c37bb5535906afae12d317408e11e91514178b0b74fa08f17d7c7c47963367a4f8768721bf2d156af2193366dc79630729bbb082f11950c14205521519f3c9f0
SSDEEP

49152:IkbrrRuQFClXJLeYyj+LZ1s3yoqKYe+Ok:InQgLz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3020	2956	rundll32.exe	31
PID 2956 wrote to memory of 3020	2956	rundll32.exe	31
PID 2956 wrote to memory of 3020	2956	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_internal\PyQt5\Qt5\bin\Qt5Location.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2956 -s 228
  2⤵
  PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-0-0x000007FEF5CB0000-0x000007FEF60A8000-memory.dmp

Filesize
4.0MB

Download