b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
170s
max time network
235s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28/03/2024, 22:46

Target

Yagami 1.0/Qt5Multimedia.dll
Size

980KB
MD5

1420e83b1e30691431627c3823dc4312
SHA1

4848215a5807323723fc5beaa5d32a2c92f58905
SHA256

267809d6cc17b54b9a1452ca03eae862d2a77a664d2665a9cf6a8aa620d100a1
SHA512

ca5817becca471d5dfd379764307001a41f888af13ab2e8a93a81e93d3f0b2d4fdc6b1fe2403b9f4e51cf48ac2559874846ffad942c4eb7b450fcf714dd48def
SSDEEP

24576:VUxxqnOXbxACBIJAB6QsHQvXxilnqSA7b7XcNOb0PxtNZOzCczaR050bGp396TOc:rOMeCJoOvrF0BhHrCjKPNW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
32	1204	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1204	1636	rundll32.exe	86
PID 1636 wrote to memory of 1204	1636	rundll32.exe	86
PID 1636 wrote to memory of 1204	1636	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Multimedia.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Multimedia.dll",#1
  2⤵
  PID:1204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 712
    3⤵
    - Program crash
    PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1204 -ip 1204
1⤵
PID:5612

memory/1204-0-0x000000006B680000-0x000000006B77C000-memory.dmp

Filesize
1008KB

Download
memory/1204-1-0x000000006EB40000-0x000000006EB64000-memory.dmp

Filesize
144KB

Download
memory/1204-2-0x000000006FE40000-0x000000006FFBE000-memory.dmp

Filesize
1.5MB

Download
memory/1204-3-0x0000000068A80000-0x0000000069044000-memory.dmp

Filesize
5.8MB

Download
memory/1204-4-0x0000000061B40000-0x0000000062136000-memory.dmp

Filesize
6.0MB

Download
memory/1204-5-0x0000000069900000-0x0000000069AC1000-memory.dmp

Filesize
1.8MB

Download
memory/1204-6-0x0000000064B40000-0x0000000064B5B000-memory.dmp

Filesize
108KB

Download