b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
152s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/04/2023, 19:12

Target

Yagami 1.0/Qt5Multimedia.dll
Size

980KB
MD5

1420e83b1e30691431627c3823dc4312
SHA1

4848215a5807323723fc5beaa5d32a2c92f58905
SHA256

267809d6cc17b54b9a1452ca03eae862d2a77a664d2665a9cf6a8aa620d100a1
SHA512

ca5817becca471d5dfd379764307001a41f888af13ab2e8a93a81e93d3f0b2d4fdc6b1fe2403b9f4e51cf48ac2559874846ffad942c4eb7b450fcf714dd48def
SSDEEP

24576:VUxxqnOXbxACBIJAB6QsHQvXxilnqSA7b7XcNOb0PxtNZOzCczaR050bGp396TOc:rOMeCJoOvrF0BhHrCjKPNW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1920	1960	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1960	1948	rundll32.exe	28
PID 1948 wrote to memory of 1960	1948	rundll32.exe	28
PID 1948 wrote to memory of 1960	1948	rundll32.exe	28
PID 1948 wrote to memory of 1960	1948	rundll32.exe	28
PID 1948 wrote to memory of 1960	1948	rundll32.exe	28
PID 1948 wrote to memory of 1960	1948	rundll32.exe	28
PID 1948 wrote to memory of 1960	1948	rundll32.exe	28
PID 1960 wrote to memory of 1920	1960	rundll32.exe	29
PID 1960 wrote to memory of 1920	1960	rundll32.exe	29
PID 1960 wrote to memory of 1920	1960	rundll32.exe	29
PID 1960 wrote to memory of 1920	1960	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Multimedia.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Multimedia.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 260
    3⤵
    - Program crash
    PID:1920

memory/1960-54-0x000000006B680000-0x000000006B77C000-memory.dmp

Filesize
1008KB

Download
memory/1960-56-0x0000000064B40000-0x0000000064B5B000-memory.dmp

Filesize
108KB

Download
memory/1960-55-0x000000006EB40000-0x000000006EB64000-memory.dmp

Filesize
144KB

Download
memory/1960-57-0x000000006FE40000-0x000000006FFBE000-memory.dmp

Filesize
1.5MB

Download
memory/1960-58-0x0000000068A80000-0x0000000069044000-memory.dmp

Filesize
5.8MB

Download
memory/1960-59-0x0000000061B40000-0x0000000062136000-memory.dmp

Filesize
6.0MB

Download
memory/1960-60-0x0000000069900000-0x0000000069AC1000-memory.dmp

Filesize
1.8MB

Download