Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/04/2023, 19:12

General

  • Target

    Yagami 1.0/Qt5Core.dll

  • Size

    5.7MB

  • MD5

    7f7f61b2edf5f4bb25b45a6e5cea83c4

  • SHA1

    4247c4e6544283c6cbecf3a479f4b3f8675ecc72

  • SHA256

    f65cccee9e53586509f5403e31214af0afaaaaf448a429715aae75dad43ab031

  • SHA512

    b1b8b9aa9c5988509aa4eb40a370c16d81ae6f922552379432567c03decea48cdf171922d3f54f95aceae3f59e1baa666020c8b306b2992fc8f3530784c5aede

  • SSDEEP

    98304:MOPpM33/G9NAHeWhMwcWqF0ywkXg4FcOBzJsv6tWKFdu9CTl4:dn9iXhMwciy5Jsv6tWKFdu9CT

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Core.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Core.dll",#1
      2⤵
        PID:2556
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 664
          3⤵
          • Program crash
          PID:1808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2556 -ip 2556
      1⤵
        PID:2496

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2556-133-0x0000000068A80000-0x0000000069044000-memory.dmp

        Filesize

        5.8MB

      • memory/2556-134-0x000000006EB40000-0x000000006EB64000-memory.dmp

        Filesize

        144KB

      • memory/2556-136-0x000000006FE40000-0x000000006FFBE000-memory.dmp

        Filesize

        1.5MB

      • memory/2556-135-0x0000000064B40000-0x0000000064B5B000-memory.dmp

        Filesize

        108KB