b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748 | Triage

Analysis

max time kernel
106s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28-03-2024 22:46

Sharing

Report Analysis Logs

General

Target

Yagami 1.0/plugins/imageformats/qgif.dll
Size

33KB
MD5

b1609ebae4fc0eebb9a42a381bd08cf8
SHA1

11dce0a0cefd34db4362ff8cce07e4802d05e465
SHA256

0e774a4e7b52ec1e237748958f8c20fc5e64d7b5838f51581bfd38be17db3229
SHA512

f10c2fc05cebc7d206a0309ab75f6568f8820370c4da2d97dde85510bf411d8538401e021190526e69b91833b1fc40c272f07826da87188e5cd77ae078bf2862
SSDEEP

768:2M+oKA8gNaSyXNeN7fh3+vfUqStnEb1bgnl:CAFaSy96OvfU9Eb9gl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3212	3700	rundll32.exe	92
PID 3700 wrote to memory of 3212	3700	rundll32.exe	92
PID 3700 wrote to memory of 3212	3700	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qgif.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qgif.dll",#1
  2⤵
  PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3424 --field-trial-handle=2244,i,4088750094024149723,14939136959417447016,262144 --variations-seed-version /prefetch:8
1⤵
PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads