b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
28/03/2024, 22:46

Target

Yagami 1.0/plugins/imageformats/qico.dll
Size

35KB
MD5

df0752b5209c3f8c6ec263bc09f9537a
SHA1

1a1d2ef581d59b18caedca05e85bf2c31e8b7313
SHA256

b8982ae083d27d201ba2d625eb061ede140e388e2604443d7fe663c4b9a5fd90
SHA512

c4b0561fa9056dc581819a377a802a1698a6aa91ec08e050904f779b74bf53e0fab011e686ff8c4252549bde47593ef7ff8959b3098efade804381c2c317bd04
SSDEEP

384:ojQGEelv+gSB+QnhbkM4REncSZ64MVlxPakOk0i3FK2P2NGb5e3woUE20ynoaNnS:0lEwQDaXQk0gP2NmeuEg9ncf

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1684	1752	rundll32.exe	28
PID 1752 wrote to memory of 1684	1752	rundll32.exe	28
PID 1752 wrote to memory of 1684	1752	rundll32.exe	28
PID 1752 wrote to memory of 1684	1752	rundll32.exe	28
PID 1752 wrote to memory of 1684	1752	rundll32.exe	28
PID 1752 wrote to memory of 1684	1752	rundll32.exe	28
PID 1752 wrote to memory of 1684	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qico.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qico.dll",#1
  2⤵
  PID:1684