b53b9796303fb2d0969dd2bf5175e6f383d0689084d2a9b43037b9dbc1298748

Analysis

max time kernel
143s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
28-03-2024 22:46

Target

Yagami 1.0/Qt5Network.dll
Size

1.7MB
MD5

8e3c478a815fd08cb404e6e8a72c1882
SHA1

e54700a53db75b683ab624ee9a79b71289433902
SHA256

a226fe78be137acc571d544ef528a1d5344bb07a2a8489b204777cd1eb52abd5
SHA512

750b2c244ad7cf9fa6702f70a3bb02676b02cf67ffeeb334ad6c275f1c26cc0e81599d0a15aeefcd038fae09c0dd96e42c7ffe62b22d135738d6c5529ef35a05
SSDEEP

49152:EyB9374wAa6uVp5nCFKZLkhu8LZTXuW8HOI:EwAnupnC4ZLW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4536	1088	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1088	4600	rundll32.exe	86
PID 4600 wrote to memory of 1088	4600	rundll32.exe	86
PID 4600 wrote to memory of 1088	4600	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Network.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Yagami 1.0\Qt5Network.dll",#1
  2⤵
  PID:1088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 704
    3⤵
    - Program crash
    PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1088 -ip 1088
1⤵
PID:3136

memory/1088-0-0x0000000068A80000-0x0000000069044000-memory.dmp

Filesize
5.8MB

Download
memory/1088-1-0x0000000069900000-0x0000000069AC1000-memory.dmp

Filesize
1.8MB

Download
memory/1088-3-0x000000006EB40000-0x000000006EB64000-memory.dmp

Filesize
144KB

Download
memory/1088-4-0x0000000064B40000-0x0000000064B5B000-memory.dmp

Filesize
108KB

Download
memory/1088-5-0x000000006FE40000-0x000000006FFBE000-memory.dmp

Filesize
1.5MB

Download