983748c25d0701763e2d22718371bc136838148f1d0918778906da5d52617f26 | Triage

Analysis

max time kernel
173s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2023 12:39

Sharing

Report Analysis Logs

General

Target

1/外挂王者吃鸡绝地辅助链接可测试_xf.exe
Size

4.9MB
MD5

5ca553a43e386baaba10a91445e7d4f3
SHA1

dedd0790bc04077148b8c5e241bf24526d78b2a6
SHA256

bf0ef973124823b86fb940facb5609dff342df7b66e0bc5e8645d48c5396a6da
SHA512

e8527bfc324cfa9b05466d6e96481c459382c969e814747f9084a375ef57aaf8b9766a4cd3fbee4cea2a4aea891cf5c3c3baa2d8a0ba4b2ab3ee6211f60fd4b1
SSDEEP

98304:rxnjv9gKioB+Egpy0+0O52GVOgswHdm6YFBifmjQ3XzHb:r5vzij3/Bifm2Xz7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3380 1300 WerFault.exe 外挂王者吃鸡绝地辅助链接可测试_xf.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

外挂王者吃鸡绝地辅助链接可测试_xf.exe

pid process

1300 外挂王者吃鸡绝地辅助链接可测试_xf.exe

C:\Users\Admin\AppData\Local\Temp\1\外挂王者吃鸡绝地辅助链接可测试_xf.exe
"C:\Users\Admin\AppData\Local\Temp\1\外挂王者吃鸡绝地辅助链接可测试_xf.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 604
2⤵
- Program crash
PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1300 -ip 1300
1⤵
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...