6d32c71e93ff0ecd5b27019a75c6c1af2af4183fa1d923bed5df6f61c2934018

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 14:45

Target

fhxy hook V0.3__/fhxy hook V0.3公开/fhxy.dll
Size

174KB
MD5

7619538fafbea49993476c73aebb340a
SHA1

52e528073d4b33ce2f4738171e435dba5efc001c
SHA256

c8c34905a614494a4e2805cf7433f4e4c60730d83b9c0ba5696b8ac1e36af553
SHA512

f5e29a9295f4ec53ed952b55fed4b2ce63a04dc91433ed8c338215ae1c6cb826382416016e4f48112bba56f864907c7c25b0732e6f6518d72e0b5f94929e5ada
SSDEEP

3072:X2FvntDrOCD+pcur2E8BQP/elrupk99IO6yQMbXmOoP5dK70qE0RNSGBxNzBt3nh:X2RtDYcurfelGNO6KbXYA0qEqSAxNzBf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2476	3600	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3600	2096	rundll32.exe	88
PID 2096 wrote to memory of 3600	2096	rundll32.exe	88
PID 2096 wrote to memory of 3600	2096	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fhxy hook V0.3__\fhxy hook V0.3公开\fhxy.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\fhxy hook V0.3__\fhxy hook V0.3公开\fhxy.dll",#1
  2⤵
  PID:3600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 588
    3⤵
    - Program crash
    PID:2476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3600 -ip 3600
1⤵
PID:3592

memory/3600-0-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download