b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
105s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28/03/2024, 22:46

Target

Yagami 1.0/Qt5Widgets.dll
Size

6.1MB
MD5

dc4c46ae3135ef9a490a8d4e3d93fc24
SHA1

46e5243b1f07f91a4c2e5be29e69b5936e951ed4
SHA256

92496e05042ec28e54eca839d0438bfe57ce3ff0a1a6579a9bb81aebe23af32a
SHA512

2079dcc289b815fdf5815e0e6d93e1d6910db126bd2befc1f585190e7cb43e7fdc056c22eb9e442c80b02439a44db0d2a7d49d9965f625e23641e6479c8020f0
SSDEEP

98304:rW25ZgW8nM/b2lLtuPfKoETZGZlNAVd/b6S2/fyQ7M1JRpM6/dNTqAg4SmpH1KJJ:VeLtjmm4M/LT3Nz/K

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5028	1340	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1340	1944	rundll32.exe	93
PID 1944 wrote to memory of 1340	1944	rundll32.exe	93
PID 1944 wrote to memory of 1340	1944	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Widgets.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Widgets.dll",#1
  2⤵
  PID:1340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 672
    3⤵
    - Program crash
    PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1340 -ip 1340
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5000 --field-trial-handle=2236,i,16103400281633466188,10996463518827761450,262144 --variations-seed-version /prefetch:8
1⤵
PID:4040

memory/1340-0-0x0000000002560000-0x0000000002B56000-memory.dmp

Filesize
6.0MB

Download
memory/1340-2-0x0000000002560000-0x0000000002B56000-memory.dmp

Filesize
6.0MB

Download
memory/1340-4-0x0000000068A80000-0x0000000069044000-memory.dmp

Filesize
5.8MB

Download
memory/1340-5-0x0000000002560000-0x0000000002B56000-memory.dmp

Filesize
6.0MB

Download
memory/1340-6-0x0000000061FC0000-0x00000000625D5000-memory.dmp

Filesize
6.1MB

Download
memory/1340-8-0x000000006EB40000-0x000000006EB64000-memory.dmp

Filesize
144KB

Download
memory/1340-9-0x000000006FE40000-0x000000006FFBE000-memory.dmp

Filesize
1.5MB

Download
memory/1340-11-0x0000000064B40000-0x0000000064B5B000-memory.dmp

Filesize
108KB

Download
memory/1340-10-0x0000000068A80000-0x0000000069044000-memory.dmp

Filesize
5.8MB

Download