c2f0f86011469b288978d72839f0c98a3642a44cfe1c02e63cd24f15e7c141e0

Analysis

max time kernel
41s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 18:47

Target

tbqpq-v1.0/淘宝秒杀器_www.gou50.com.exe
Size

40KB
MD5

31c506ff4c689c6b44e3d98f7dcffc8b
SHA1

c10ddb709884f86849423b1c892f91ac24f166ff
SHA256

2ff4f47c50ac765e0ad570f83e2d5288a81ab1ac778757f73a0d74dc8ad45aed
SHA512

3c32b3e9e83ea5cb0c438346b1d2d62ace1f46be62f799b2dfeb3d41b62ec5fe00ba73341b7b835e55bdb51a1a70e132130d73e3b24b46d290a938f80b8cc88a
SSDEEP

384:GT7hkqO2+0TryUoz+1qbW24F48fW9LkctBXkOzi4pPiuBuy:G/+p0Tm9W2qQ9v7/ioiuBu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	1396	WerFault.exe	10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 952	1396	淘宝秒杀器_www.gou50.com.exe	27
PID 1396 wrote to memory of 952	1396	淘宝秒杀器_www.gou50.com.exe	27
PID 1396 wrote to memory of 952	1396	淘宝秒杀器_www.gou50.com.exe	27
PID 1396 wrote to memory of 952	1396	淘宝秒杀器_www.gou50.com.exe	27

C:\Users\Admin\AppData\Local\Temp\tbqpq-v1.0\淘宝秒杀器_www.gou50.com.exe
"C:\Users\Admin\AppData\Local\Temp\tbqpq-v1.0\淘宝秒杀器_www.gou50.com.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 148
  2⤵
  - Program crash
  PID:952