ff6900c6e3591dbe76ed5985c267146b02d4992a5cbf5837f6f1e99c55ec6caa

Analysis

max time kernel
152s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 18:38

Target

CF唯爱无后准星方框透视稳定版08月21日SP1.exe
Size

1.5MB
MD5

fa03a4af8f63b9af75a0c938f742e4d5
SHA1

866a878bcac255621b19b66dbf4bdb46b7379ae7
SHA256

1e8ef622a8945b78423aba4b8f9a810a02722328337a3d582b4c7108c336bb14
SHA512

736f8875cbe5701bbdafdf72ef3de68650536021dd3d788bfa1f71ea770b836b18dee03a869f4a4453d48dc3d54d5d7b8b91952649a3bf118656fa67c2d0a0bd
SSDEEP

24576:cG8zXXBsIJbJNn9+seKvKCISQJEhd8oRyrFdixpebBBFWqqnn4gWU4M:18ryIJP0jCIf9oWyxoBFWq0tWUj

Score

3^/10

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4336	4656	WerFault.exe	81
4484	4656	WerFault.exe	81
4416	4656	WerFault.exe	81
2832	4656	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4336	4656	CF唯爱无后准星方框透视稳定版08月21日SP1.exe	83
PID 4656 wrote to memory of 4336	4656	CF唯爱无后准星方框透视稳定版08月21日SP1.exe	83
PID 4656 wrote to memory of 4336	4656	CF唯爱无后准星方框透视稳定版08月21日SP1.exe	83

C:\Users\Admin\AppData\Local\Temp\CF唯爱无后准星方框透视稳定版08月21日SP1.exe
"C:\Users\Admin\AppData\Local\Temp\CF唯爱无后准星方框透视稳定版08月21日SP1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 228
  2⤵
  - Program crash
  PID:4336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 228
  2⤵
  - Program crash
  PID:4484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 228
  2⤵
  - Program crash
  PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 300
  2⤵
  - Program crash
  PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4656 -ip 4656
1⤵
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4656 -ip 4656
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4656 -ip 4656
1⤵
PID:776

memory/4656-132-0x0000000000400000-0x00000000006C0011-memory.dmp

Filesize
2.8MB

Download
memory/4656-133-0x0000000000400000-0x00000000006C0011-memory.dmp

Filesize
2.8MB

Download
memory/4656-135-0x0000000000400000-0x00000000006C0011-memory.dmp

Filesize
2.8MB

Download