9eef6e2d4e5d2511a3fb86645bc5ae5d239a58da5b5650470a5deece1c731668

Analysis

max time kernel
90s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 21:22

Target

傳奇守護者免费版1.8.9/detection/ws.exe
Size

676KB
MD5

84cdd4384eebcf86f1aefc50701122bf
SHA1

d6f75bcc551b21fbe33db0e41952d55a1072bcce
SHA256

20e96f9bb5a4f8fae370f7e651fff9c5f5444b4c3233168608542b1e92a5f18b
SHA512

5a0ab12edcd4787ba5244a74b1032a13c8801ae088be867d577a1d59fc666642e5f63db6234d61941b7fdf439df59600633cd7969cc63136d2357d179dae939f
SSDEEP

6144:uO3d/K8BCr9gggJqbQUBauavwwQkykaMLeReCicYHAce4te1CfOA7l5Ww/Mlkne:uutm9dg2BIowQkykzweNPe16LWw

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1848 3036 WerFault.exe ws.exe
3124 3036 WerFault.exe ws.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ws.exe

pid process

3036 ws.exe
3036 ws.exe

pid	pid_target	process	target process
1848	3036	WerFault.exe	ws.exe
3124	3036	WerFault.exe	ws.exe

pid	process
3036	ws.exe
3036	ws.exe

C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\ws.exe
"C:\Users\Admin\AppData\Local\Temp\傳奇守護者免费版1.8.9\detection\ws.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 704
2⤵
- Program crash
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 584
2⤵
- Program crash
PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3036 -ip 3036
1⤵
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3036 -ip 3036
1⤵
PID:308