597c644db7648b6ccc73d997b23b04be5053e352ecad38dd09936922d29df035 | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 16:23

Sharing

Report Analysis Logs

General

Target

die_win64_portable/Qt5ScriptTools.dll
Size

555KB
MD5

dd9fecbf34374972577a058e5a4c7c3d
SHA1

16c3114a75a2eced0104428dc779a3dbda951cc0
SHA256

ad25c27bc99075b4883a9bf7943954094885798969038d46785e0fd1ec1ccbc2
SHA512

8aeeca34b63930564d42056ca1b7d3c59d6fe017b19e86fb294fafab982a014b09bbc40f32a9cc5d36c8afa13d7863ba4f144ab6a4af465acbc8a6a72f6d8554
SSDEEP

12288:HnZlvw+mZfMDFfRRLLUTF5xQFa3J5cbQ0:HnZlvw+mVmFfRRLLYFHQF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2600	1268	rundll32.exe	31
PID 1268 wrote to memory of 2600	1268	rundll32.exe	31
PID 1268 wrote to memory of 2600	1268	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\die_win64_portable\Qt5ScriptTools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1268 -s 216
  2⤵
  PID:2600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-0-0x000007FEF56B0000-0x000007FEF5BF1000-memory.dmp

Filesize
5.3MB

Download