a72d37d2563dd4c60df9c78c36f0696d70694641415e1b5e53fd9a7da00be5fc

Analysis

max time kernel
142s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:36

Target

QQ农场挂挂V8.0带定时版去广告byLoading/SkinH_EL. dll.exe
Size

153KB
MD5

4955751ccd30379b353fc7a34d68bef5
SHA1

8e844e85f97783e7040cbf885dd1f3a977b80860
SHA256

b90eff00f6c20def0a7de71a6da9d66a2a18045856b28d75d29d63654b271e95
SHA512

36d56efac99fb66db502d8b9576de5c8fe0885ed94fe5afe6914d1c566522c9c23bbe6d26ed2c9d3aee1fd7a50b1c55a3a3c5cbee44fa92fb708e930d76679b9
SSDEEP

3072:APQpbKAIiuB+ZLtHC5q/nsLkce2gpoZskMX2jGCPGd2RjXEGwbIXi:APhImEUgek2jGCeAQ7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	1688	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 3056	1688	SkinH_EL. dll.exe	29
PID 1688 wrote to memory of 3056	1688	SkinH_EL. dll.exe	29
PID 1688 wrote to memory of 3056	1688	SkinH_EL. dll.exe	29
PID 1688 wrote to memory of 3056	1688	SkinH_EL. dll.exe	29

C:\Users\Admin\AppData\Local\Temp\QQ农场挂挂V8.0带定时版去广告byLoading\SkinH_EL. dll.exe
"C:\Users\Admin\AppData\Local\Temp\QQ农场挂挂V8.0带定时版去广告byLoading\SkinH_EL. dll.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 152
  2⤵
  - Program crash
  PID:3056

memory/1688-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download