b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231129-es
resource tags

arch:x64arch:x86image:win7-20231129-eslocale:es-esos:windows7-x64systemwindows
submitted
28/03/2024, 22:46

Sharing

Report Analysis Logs

General

Target

Yagami 1.0/plugins/imageformats/qgif.dll
Size

33KB
MD5

b1609ebae4fc0eebb9a42a381bd08cf8
SHA1

11dce0a0cefd34db4362ff8cce07e4802d05e465
SHA256

0e774a4e7b52ec1e237748958f8c20fc5e64d7b5838f51581bfd38be17db3229
SHA512

f10c2fc05cebc7d206a0309ab75f6568f8820370c4da2d97dde85510bf411d8538401e021190526e69b91833b1fc40c272f07826da87188e5cd77ae078bf2862
SSDEEP

768:2M+oKA8gNaSyXNeN7fh3+vfUqStnEb1bgnl:CAFaSy96OvfU9Eb9gl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2988	2940	rundll32.exe	28
PID 2940 wrote to memory of 2988	2940	rundll32.exe	28
PID 2940 wrote to memory of 2988	2940	rundll32.exe	28
PID 2940 wrote to memory of 2988	2940	rundll32.exe	28
PID 2940 wrote to memory of 2988	2940	rundll32.exe	28
PID 2940 wrote to memory of 2988	2940	rundll32.exe	28
PID 2940 wrote to memory of 2988	2940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qgif.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qgif.dll",#1
  2⤵
  PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads