ca493000c5eaff8432d6e2f3fc11a35fc019f1ff30806c661fba26e9941b5fb7

Analysis

max time kernel
143s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 09:55

Target
GongShaFuZhu13/【x1】攻沙辅助/plugin/FILE.dll
Size 40KB
Sample240110-lxswpaebc5
SHA256 c9515d3d0e549e978fdd8ae762bd7b73f1ec1dd49c058ad9cd4537902db87670
MD5 1b12290100f56cf13ac7bd631adebe7d
SHA1 d996c99e4ccb91876e9da397ec547aebb83c0c94
SHA512 cd0e417f7ef5d1749f78bded6ac77bcc15aa72268bbb2ec8322f964a11d70f0ecfaaa4ecc10d13a2df743329982bd88fdb8f7f785a50dad33d112e27e372b815
SSDEEP 384:Ik5Y5bNAguM1vVOiignzJjaJ5htgk0jDrmq5pp/xI3eYP5zo9Y:I4Y5pZVLiQJmltgrjDrmq5/K3ce
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3504	2376	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2376	1876	regsvr32.exe	14
PID 1876 wrote to memory of 2376	1876	regsvr32.exe	14
PID 1876 wrote to memory of 2376	1876	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\plugin\FILE.dll
1⤵
PID:2376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 672
  2⤵
  - Program crash
  PID:3504

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\GongShaFuZhu13\【x1】攻沙辅助\plugin\FILE.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2376 -ip 2376
1⤵
PID:3876