3b62a9df05fdc4a4dde776ca7e0055f5b3e934f9bea2bfb5779979d815861b9a

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 02:52

Target

暗黑修仙登录器/暗黑修仙登录器.exe
Size

2.4MB
MD5

7882116db19dc891772558f67c2ec04c
SHA1

07af2659ee09c84d41c61bd1f7463343f249f0ee
SHA256

8d39fea03a9e4bdfa9f1c0049cf32b72944eee7246b8c18aee21107bf52a85ff
SHA512

bdb4cd5f58ea132f4b7d730140b8989cda46dfda2564754abb20cd67738f3627f03f46ffe5243453da59f608e885826edca372ae289bdae49b7d1bc5a295aa7b
SSDEEP

49152:xvWdKorxp/zmf7YJEn7reeaYTwd62nmhY222WWWWx22XY/222WWWWx22+M:sI4xp88E7qVYMdEhY222WWWWx22I/22O

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2040	1184	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2040	1184	暗黑修仙登录器.exe	27
PID 1184 wrote to memory of 2040	1184	暗黑修仙登录器.exe	27
PID 1184 wrote to memory of 2040	1184	暗黑修仙登录器.exe	27
PID 1184 wrote to memory of 2040	1184	暗黑修仙登录器.exe	27

C:\Users\Admin\AppData\Local\Temp\暗黑修仙登录器\暗黑修仙登录器.exe
"C:\Users\Admin\AppData\Local\Temp\暗黑修仙登录器\暗黑修仙登录器.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 204
  2⤵
  - Program crash
  PID:2040

memory/1184-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1184-56-0x0000000000400000-0x000000000068D000-memory.dmp

Filesize
2.6MB

Download