b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
143s
max time network
132s
platform
windows7_x64
resource
win7-20240319-es
resource tags

arch:x64arch:x86image:win7-20240319-eslocale:es-esos:windows7-x64systemwindows
submitted
28-03-2024 22:46

Target

Yagami 1.0/Qt5Network.dll
Size

1.7MB
MD5

8e3c478a815fd08cb404e6e8a72c1882
SHA1

e54700a53db75b683ab624ee9a79b71289433902
SHA256

a226fe78be137acc571d544ef528a1d5344bb07a2a8489b204777cd1eb52abd5
SHA512

750b2c244ad7cf9fa6702f70a3bb02676b02cf67ffeeb334ad6c275f1c26cc0e81599d0a15aeefcd038fae09c0dd96e42c7ffe62b22d135738d6c5529ef35a05
SSDEEP

49152:EyB9374wAa6uVp5nCFKZLkhu8LZTXuW8HOI:EwAnupnC4ZLW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	1680	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1680	2168	rundll32.exe	28
PID 2168 wrote to memory of 1680	2168	rundll32.exe	28
PID 2168 wrote to memory of 1680	2168	rundll32.exe	28
PID 2168 wrote to memory of 1680	2168	rundll32.exe	28
PID 2168 wrote to memory of 1680	2168	rundll32.exe	28
PID 2168 wrote to memory of 1680	2168	rundll32.exe	28
PID 2168 wrote to memory of 1680	2168	rundll32.exe	28
PID 1680 wrote to memory of 2992	1680	rundll32.exe	29
PID 1680 wrote to memory of 2992	1680	rundll32.exe	29
PID 1680 wrote to memory of 2992	1680	rundll32.exe	29
PID 1680 wrote to memory of 2992	1680	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Network.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Network.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 260
    3⤵
    - Program crash
    PID:2992

memory/1680-0-0x0000000068A80000-0x0000000069044000-memory.dmp

Filesize
5.8MB

Download
memory/1680-1-0x0000000069900000-0x0000000069AC1000-memory.dmp

Filesize
1.8MB

Download
memory/1680-3-0x000000006EB40000-0x000000006EB64000-memory.dmp

Filesize
144KB

Download
memory/1680-4-0x0000000064B40000-0x0000000064B5B000-memory.dmp

Filesize
108KB

Download
memory/1680-5-0x000000006FE40000-0x000000006FFBE000-memory.dmp

Filesize
1.5MB

Download