dd734da63b25cfc2ddbe0be31fc25577bffe846b6171f2ee10f659a9edce1beb

Analysis

max time kernel
144s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 02:12

Target

1K-6K后台接力2.20版/plugin/BGKMS3_02.dll
Size

96KB
MD5

e65de8c94c0525fd7c0a4d0af4b4c1b0
SHA1

cfab911db6251c374173f10d37c7a4843224778e
SHA256

b125dfbd8d635e199dc8888ed0c86b6b87672fa765944dcbc7a24b4a182847b0
SHA512

2ef311ef90d915a0d41115c27e3fcc85132f02fea21953f4b73981a18528306856c2b74b7163452251b5142034b28609330e3a249468762c34eafebf2c72d019
SSDEEP

1536:tQKJvv7aSa3wYgsHRbA12GKV7PzW7VmPfj3H3TMvER77/NqK+WHUmjRth:CKlaSagYdHRbA12GKV7PzW7VmPfj3H3b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
396	736	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 736	4364	regsvr32.exe	79
PID 4364 wrote to memory of 736	4364	regsvr32.exe	79
PID 4364 wrote to memory of 736	4364	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1K-6K后台接力2.20版\plugin\BGKMS3_02.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\1K-6K后台接力2.20版\plugin\BGKMS3_02.dll
  2⤵
  PID:736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 624
    3⤵
    - Program crash
    PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 736 -ip 736
1⤵
PID:1440