b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
116s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28/03/2024, 22:46

Target

Yagami 1.0/plugins/imageformats/qicnsd.dll
Size

894KB
MD5

8e2c9338e4f3778637fbd7cdb363cec9
SHA1

41cd1a42ef7e8c6a583c4ab40da50e861ebd5c7d
SHA256

43b1fa696058065f043ececbad7c1f4739ebf021932ba6b0c443b1ecc94c1581
SHA512

984e666490eeefca982ace7a0a58b107b345511640988886bacb2c3b55b0a1d1723a2ac5eb1d3ef6adc7a50888cb29d9dee944e2199ed3da8063c5b328a2f0fd
SSDEEP

24576:2vQZ2a8d9dtEcohnmQWHtsHQ1JNmJlA8NFHtzt:6tEcohnmQWHtsw1JNmJlvz

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 4136	2052	rundll32.exe	96
PID 2052 wrote to memory of 4136	2052	rundll32.exe	96
PID 2052 wrote to memory of 4136	2052	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qicnsd.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qicnsd.dll",#1
  2⤵
  PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4892 --field-trial-handle=1984,i,6250324430674571549,669234090731242346,262144 --variations-seed-version /prefetch:8
1⤵
PID:2604