b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
141s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/04/2023, 19:12

Target

Yagami 1.0/Qt5Network.dll
Size

1.7MB
MD5

8e3c478a815fd08cb404e6e8a72c1882
SHA1

e54700a53db75b683ab624ee9a79b71289433902
SHA256

a226fe78be137acc571d544ef528a1d5344bb07a2a8489b204777cd1eb52abd5
SHA512

750b2c244ad7cf9fa6702f70a3bb02676b02cf67ffeeb334ad6c275f1c26cc0e81599d0a15aeefcd038fae09c0dd96e42c7ffe62b22d135738d6c5529ef35a05
SSDEEP

49152:EyB9374wAa6uVp5nCFKZLkhu8LZTXuW8HOI:EwAnupnC4ZLW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	1776	WerFault.exe	26

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1776	1144	rundll32.exe	26
PID 1144 wrote to memory of 1776	1144	rundll32.exe	26
PID 1144 wrote to memory of 1776	1144	rundll32.exe	26
PID 1144 wrote to memory of 1776	1144	rundll32.exe	26
PID 1144 wrote to memory of 1776	1144	rundll32.exe	26
PID 1144 wrote to memory of 1776	1144	rundll32.exe	26
PID 1144 wrote to memory of 1776	1144	rundll32.exe	26
PID 1776 wrote to memory of 2040	1776	rundll32.exe	27
PID 1776 wrote to memory of 2040	1776	rundll32.exe	27
PID 1776 wrote to memory of 2040	1776	rundll32.exe	27
PID 1776 wrote to memory of 2040	1776	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Network.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Network.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 260
    3⤵
    - Program crash
    PID:2040

memory/1776-54-0x0000000069900000-0x0000000069AC1000-memory.dmp

Filesize
1.8MB

Download
memory/1776-55-0x000000006EB40000-0x000000006EB64000-memory.dmp

Filesize
144KB

Download
memory/1776-56-0x0000000064B40000-0x0000000064B5B000-memory.dmp

Filesize
108KB

Download
memory/1776-57-0x000000006FE40000-0x000000006FFBE000-memory.dmp

Filesize
1.5MB

Download
memory/1776-58-0x0000000068A80000-0x0000000069044000-memory.dmp

Filesize
5.8MB

Download