Analysis
-
max time kernel
175s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 22:36
Behavioral task
behavioral1
Sample
QQ农场挂挂V8.0带定时版去广告byLoading/SkinH_EL. dll.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
QQ农场挂挂V8.0带定时版去广告byLoading/SkinH_EL. dll.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
QQ农场挂挂V8.0带定时版去广告byLoading/SkinH_EL.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
QQ农场挂挂V8.0带定时版去广告byLoading/SkinH_EL.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
QQ农场挂挂V8.0带定时版去广告byLoading/新云软件.url
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
QQ农场挂挂V8.0带定时版去广告byLoading/新云软件.url
Resource
win10v2004-20231215-en
General
-
Target
QQ农场挂挂V8.0带定时版去广告byLoading/SkinH_EL. dll.exe
-
Size
153KB
-
MD5
4955751ccd30379b353fc7a34d68bef5
-
SHA1
8e844e85f97783e7040cbf885dd1f3a977b80860
-
SHA256
b90eff00f6c20def0a7de71a6da9d66a2a18045856b28d75d29d63654b271e95
-
SHA512
36d56efac99fb66db502d8b9576de5c8fe0885ed94fe5afe6914d1c566522c9c23bbe6d26ed2c9d3aee1fd7a50b1c55a3a3c5cbee44fa92fb708e930d76679b9
-
SSDEEP
3072:APQpbKAIiuB+ZLtHC5q/nsLkce2gpoZskMX2jGCPGd2RjXEGwbIXi:APhImEUgek2jGCeAQ7
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2076 1840 WerFault.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\QQ农场挂挂V8.0带定时版去广告byLoading\SkinH_EL. dll.exe"C:\Users\Admin\AppData\Local\Temp\QQ农场挂挂V8.0带定时版去广告byLoading\SkinH_EL. dll.exe"1⤵PID:1840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 4282⤵
- Program crash
PID:2076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1840 -ip 18401⤵PID:4320