983748c25d0701763e2d22718371bc136838148f1d0918778906da5d52617f26 | Triage

Analysis

max time kernel
119s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 12:39

Sharing

Report Analysis Logs

General

Target

1/外挂王者吃鸡绝地辅助链接可测试_xf.exe
Size

4.9MB
MD5

5ca553a43e386baaba10a91445e7d4f3
SHA1

dedd0790bc04077148b8c5e241bf24526d78b2a6
SHA256

bf0ef973124823b86fb940facb5609dff342df7b66e0bc5e8645d48c5396a6da
SHA512

e8527bfc324cfa9b05466d6e96481c459382c969e814747f9084a375ef57aaf8b9766a4cd3fbee4cea2a4aea891cf5c3c3baa2d8a0ba4b2ab3ee6211f60fd4b1
SSDEEP

98304:rxnjv9gKioB+Egpy0+0O52GVOgswHdm6YFBifmjQ3XzHb:r5vzij3/Bifm2Xz7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2692 2068 WerFault.exe 外挂王者吃鸡绝地辅助链接可测试_xf.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

外挂王者吃鸡绝地辅助链接可测试_xf.exe

pid process

2068 外挂王者吃鸡绝地辅助链接可测试_xf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

外挂王者吃鸡绝地辅助链接可测试_xf.exe

description	pid	process	target process
PID 2068 wrote to memory of 2692	2068	外挂王者吃鸡绝地辅助链接可测试_xf.exe	WerFault.exe
PID 2068 wrote to memory of 2692	2068	外挂王者吃鸡绝地辅助链接可测试_xf.exe	WerFault.exe
PID 2068 wrote to memory of 2692	2068	外挂王者吃鸡绝地辅助链接可测试_xf.exe	WerFault.exe
PID 2068 wrote to memory of 2692	2068	外挂王者吃鸡绝地辅助链接可测试_xf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\1\外挂王者吃鸡绝地辅助链接可测试_xf.exe
"C:\Users\Admin\AppData\Local\Temp\1\外挂王者吃鸡绝地辅助链接可测试_xf.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 256
2⤵
- Program crash
PID:2692

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...