b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
28s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/04/2023, 19:12

Target

Yagami 1.0/plugins/imageformats/qicns.dll
Size

45KB
MD5

e7a660bd83caecd1cbcbb42a3e83cfbe
SHA1

17455829a4c0ea0517f95b846e6b474d9ec3e3cf
SHA256

3e11cb1d1c6624c25ed8c3b583b4ded62eed0bf87fbb091631bf3dd06e070e16
SHA512

9a1aeac2c6d738921718f04160509381c8f8537464ffa7527530b5a3fe6be0543d2fc6072fdf7e57ef1e97345bdaa4351b0f70f294eae4f10a0e266a49157d2c
SSDEEP

384:Uup9bNsDSFyT3jAdL8vl9o2X0+qqQAtfgZL+xc7s4jM89PdNzd/FJ1GwGJtOkGHO:lwWGgOlgZSxAs101xd/FueJ1rUrEC6t

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1832	1204	rundll32.exe	28
PID 1204 wrote to memory of 1832	1204	rundll32.exe	28
PID 1204 wrote to memory of 1832	1204	rundll32.exe	28
PID 1204 wrote to memory of 1832	1204	rundll32.exe	28
PID 1204 wrote to memory of 1832	1204	rundll32.exe	28
PID 1204 wrote to memory of 1832	1204	rundll32.exe	28
PID 1204 wrote to memory of 1832	1204	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qicns.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qicns.dll",#1
  2⤵
  PID:1832