597c644db7648b6ccc73d997b23b04be5053e352ecad38dd09936922d29df035 | Triage

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 16:23

Sharing

Report Analysis Logs

General

Target

die_win64_portable/Qt5Svg.dll
Size

322KB
MD5

03761f923e52a7269a6e3a7452f6be93
SHA1

2ce53c424336bcc8047e10fa79ce9bce14059c50
SHA256

7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
SHA512

de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
SSDEEP

6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 776	1808	rundll32.exe	31
PID 1808 wrote to memory of 776	1808	rundll32.exe	31
PID 1808 wrote to memory of 776	1808	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\die_win64_portable\Qt5Svg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1808 -s 216
  2⤵
  PID:776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-0-0x000007FEF6390000-0x000007FEF68D1000-memory.dmp

Filesize
5.3MB

Download