597c644db7648b6ccc73d997b23b04be5053e352ecad38dd09936922d29df035

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 16:23

Target

die_win64_portable/Qt5Widgets.dll
Size

5.2MB
MD5

4cd1f8fdcd617932db131c3688845ea8
SHA1

b090ed884b07d2d98747141aefd25590b8b254f9
SHA256

3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
SHA512

7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP

49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 2352	564	rundll32.exe	30
PID 564 wrote to memory of 2352	564	rundll32.exe	30
PID 564 wrote to memory of 2352	564	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\die_win64_portable\Qt5Widgets.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 564 -s 220
  2⤵
  PID:2352

memory/564-0-0x000007FEF6B00000-0x000007FEF7041000-memory.dmp

Filesize
5.3MB

Download