c2d7bd36651438dc46e8519dcaccff7fbbe838ee3e9b7f875893c7cf9a3493a1

Analysis

max time kernel
185s
max time network
235s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 00:59

Target

hxsyfzgj_56086/YY幻想神域辅助0804/ds30试用版（笔记本小屏幕用）.exe
Size

70KB
MD5

cc886ac7b9ca389cc5ad438b71968055
SHA1

0ba244e6b24b7f4a1775da5ce062c25c205ca9a8
SHA256

87062f6a1b2dd83cd25e71fb9c40c178331cf35d1c4b31d799c2adcd36ae051e
SHA512

964307456ec82608a4c73d2caf2db21bb17ca956acc0001cd5664c180ebaee696f511de2e8f0a4ed467da06833cb09269c7b27385dc9cc8d99f97368544a47a7
SSDEEP

1536:hix4GTf3cAiUz13Wp9626ApvrlVJ4E5s:y4sciz1392rDd4Ms

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2360	1668	WerFault.exe	80
4992	1668	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2360	1668	ds30试用版（笔记本小屏幕用）.exe	87
PID 1668 wrote to memory of 2360	1668	ds30试用版（笔记本小屏幕用）.exe	87
PID 1668 wrote to memory of 2360	1668	ds30试用版（笔记本小屏幕用）.exe	87

C:\Users\Admin\AppData\Local\Temp\hxsyfzgj_56086\YY幻想神域辅助0804\ds30试用版（笔记本小屏幕用）.exe
"C:\Users\Admin\AppData\Local\Temp\hxsyfzgj_56086\YY幻想神域辅助0804\ds30试用版（笔记本小屏幕用）.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 708
  2⤵
  - Program crash
  PID:2360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 708
  2⤵
  - Program crash
  PID:4992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1668 -ip 1668
1⤵
PID:2608

memory/1668-133-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1668-135-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download