597c644db7648b6ccc73d997b23b04be5053e352ecad38dd09936922d29df035 | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 16:23

Sharing

Report Analysis Logs

General

Target

die_win64_portable/Qt5Script.dll
Size

1.2MB
MD5

03c6c0a60c0d3e7fa86b4388f4cbccb6
SHA1

cddaa47fd8c1a7de32c2376f27edcfc594e92074
SHA256

0b58e5e79df13110a8258f14d7b3658d1dd0c8dddc337a164b89d4ac12a0638f
SHA512

a297db87ee1055190580ad2bc539e89e38729dcb9ea9075dc535b05cb45c62f1b0fc99d8866047383cf519d7dde4016cc4ee0d5796190635aeb3d5c2f5e7cd2b
SSDEEP

24576:xO2knvJZKtd04kMCZZGiCS2BULn64WYdyczxJlH:xO2knvJZIgMCqonlrDH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2808	2612	rundll32.exe	30
PID 2612 wrote to memory of 2808	2612	rundll32.exe	30
PID 2612 wrote to memory of 2808	2612	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\die_win64_portable\Qt5Script.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2612 -s 212
  2⤵
  PID:2808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads