7b789067fc92947c089c7bd54324742156f04d7a2d670de4e5170c87abf72f3d

Analysis

max time kernel
7s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/12/2024, 23:42

Target

_internal/PyQt5/Qt5/bin/Qt5Multimedia.dll
Size

728KB
MD5

01df79071f9da0b9b7bda3db7fdc8809
SHA1

6944acc06f8691a27aa0833d29f0389f0e036bf0
SHA256

1a59ae2a9ff768ad6bfb888fe3dd2544e238f0b28da83cf375ebd803ce713dc4
SHA512

486d3f93e56ab50e0c9937e3472762946afdbb28279818d42081f5784f3af2df6d55253d4cf4839601058dcefb5e543144b91b4572bed96ca9926a0a2afe5711
SSDEEP

6144:jLIJMPFfMerCs1uXdHbbbboLxywnY9jnvQz5dm9mMhI/p5PQCf3FR19EjqD0jKds:j+MPFfMervUXzYeg/mR4G

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2028	2280	rundll32.exe	29
PID 2280 wrote to memory of 2028	2280	rundll32.exe	29
PID 2280 wrote to memory of 2028	2280	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_internal\PyQt5\Qt5\bin\Qt5Multimedia.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2280 -s 232
  2⤵
  PID:2028