b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
100s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2023, 19:12

Target

Yagami 1.0/Qt5Network.dll
Size

1.7MB
MD5

8e3c478a815fd08cb404e6e8a72c1882
SHA1

e54700a53db75b683ab624ee9a79b71289433902
SHA256

a226fe78be137acc571d544ef528a1d5344bb07a2a8489b204777cd1eb52abd5
SHA512

750b2c244ad7cf9fa6702f70a3bb02676b02cf67ffeeb334ad6c275f1c26cc0e81599d0a15aeefcd038fae09c0dd96e42c7ffe62b22d135738d6c5529ef35a05
SSDEEP

49152:EyB9374wAa6uVp5nCFKZLkhu8LZTXuW8HOI:EwAnupnC4ZLW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3908	1424	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 1424	4252	rundll32.exe	83
PID 4252 wrote to memory of 1424	4252	rundll32.exe	83
PID 4252 wrote to memory of 1424	4252	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Network.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Network.dll",#1
  2⤵
  PID:1424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 704
    3⤵
    - Program crash
    PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1424 -ip 1424
1⤵
PID:1196

memory/1424-134-0x0000000069900000-0x0000000069AC1000-memory.dmp

Filesize
1.8MB

Download
memory/1424-136-0x000000006FE40000-0x000000006FFBE000-memory.dmp

Filesize
1.5MB

Download
memory/1424-135-0x000000006EB40000-0x000000006EB64000-memory.dmp

Filesize
144KB

Download
memory/1424-137-0x0000000068A80000-0x0000000069044000-memory.dmp

Filesize
5.8MB

Download
memory/1424-138-0x0000000064B40000-0x0000000064B5B000-memory.dmp

Filesize
108KB

Download