b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231129-es
resource tags

arch:x64arch:x86image:win7-20231129-eslocale:es-esos:windows7-x64systemwindows
submitted
28/03/2024, 22:46

Target

Yagami 1.0/plugins/imageformats/qjpeg.dll
Size

242KB
MD5

f84d4e2c3f4cfc77b67f8a92e9024d45
SHA1

aeffce56263ca68ef9256682e393f4f2ef9df3cb
SHA256

3325437e8926a457dccac7ff726b84e6c963bf046f67cc3d0f1defe32a098f2b
SHA512

8254a8e3fe66da4dbeb3d33abc0974d53d4016f0d9c3e5e5e8e93ea0443d959a71bfceb9240b5a1cf024a214e9c44dc6466d56b4ea6408c5210d5e11d498d0e8
SSDEEP

6144:D3NnoxKqcg9Bm7VjnBuytADmITVy7tOvbLyu9LdE:D3NlqcgLm7VjnMN9bL

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2360	1940	rundll32.exe	28
PID 1940 wrote to memory of 2360	1940	rundll32.exe	28
PID 1940 wrote to memory of 2360	1940	rundll32.exe	28
PID 1940 wrote to memory of 2360	1940	rundll32.exe	28
PID 1940 wrote to memory of 2360	1940	rundll32.exe	28
PID 1940 wrote to memory of 2360	1940	rundll32.exe	28
PID 1940 wrote to memory of 2360	1940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qjpeg.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\plugins\imageformats\qjpeg.dll",#1
  2⤵
  PID:2360