b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
65s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28/03/2024, 22:46

Target

Yagami 1.0/plugins/imageformats/qgifd.dll
Size

1021KB
MD5

ea6e5fa1f4a79e4ab39cc89468b687c5
SHA1

dcd677deb622c4937b4a186397aa252b692e8792
SHA256

bdcdc033a36139cee3d2c4ee589211366030c45123b41cd5aa3b5bdc4d3bdf8d
SHA512

4e3442e7d62c0278d3e6a0e344c446015669911768932fa22922db32ba4492b7e27f9c8740e65df3a5ff1664c922570ff49b22b1b8f3ea5ecdb47f0bed8c61c2
SSDEEP

12288:TCmHL2E1KynSaSjkHFCS/3uHMrMwRsrBLy:TCmrFKyntSjkB/3uHMdsrBLy

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4916	3480	rundll32.exe	89
PID 3480 wrote to memory of 4916	3480	rundll32.exe	89
PID 3480 wrote to memory of 4916	3480	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qgifd.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qgifd.dll",#1
  2⤵
  PID:4916