9eef6e2d4e5d2511a3fb86645bc5ae5d239a58da5b5650470a5deece1c731668

Analysis

max time kernel
248s
max time network
281s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:22

Target

傳奇守護者免费版1.8.9/detection/tempj/jx.exe
Size

688KB
MD5

77a1139843a33ac7ae469e4048d6186b
SHA1

e18f5488701b73796903a751596e03869974c5fe
SHA256

d52c8301f09895484e2771149ed024cb52ac70c0742f717c76f5f7079c675d7c
SHA512

2208883f919ab02451ef12bf101f0a0b9f00f48fd590ff5ee80454619f561059fb6af9eae83adb3ac71f7fbaf77a785e6f703398f876305c92e0f6c4134306cf
SSDEEP

6144:TcXjzqjtlL8dcWzu2gB+5Ycp/nqYQsssbmTzps5idMDmH06Z2nQeOg0pPsS2:TcT+WSWzu2QIXEBs5KH0bnQeOg

Score

3^/10

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4720 3636 WerFault.exe jx.exe
3748 3636 WerFault.exe jx.exe
1460 3636 WerFault.exe jx.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

jx.exe

pid process

3636 jx.exe
3636 jx.exe

pid	pid_target	process	target process
4720	3636	WerFault.exe	jx.exe
3748	3636	WerFault.exe	jx.exe
1460	3636	WerFault.exe	jx.exe

pid	process
3636	jx.exe
3636	jx.exe

C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\tempj\jx.exe
"C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\tempj\jx.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 680
2⤵
- Program crash
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 644
2⤵
- Program crash
PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 684
2⤵
- Program crash
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3636 -ip 3636
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3636 -ip 3636
1⤵
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3636 -ip 3636
1⤵
PID:2588