99032750d18472040619864f6ef0ad0dfb3aa1bb42aae6e96863356775931684 | Triage

Analysis

max time kernel
131s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 23:37

Sharing

Report Analysis Logs

General

Target

QQJQSF/QQGame.dll
Size

56KB
MD5

19525c2db0c299c8a67ccab7861c8cbc
SHA1

b9d1a8f72d26cfabbdc064f013ec32c79661aed9
SHA256

45894f229c9ec02c76351c6b96a511dec861c1839685aad69c4d3eaf492bd7f8
SHA512

a36db80b970e6a99845ba3a54d310ac281b725064792ae035b194f29b9e8e609262a35e5446f4720d11c1bcecedbdd8a0260d9693ec88e84fe211a755f96e712
SSDEEP

1536:thPn3JpuZB6vL0I8L3V5S38/Hyumtmku4B0PutCVo/tC5:fnDuaT0H3V5fHyrmpU0QA

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3864	3652	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 3652	2432	rundll32.exe	85
PID 2432 wrote to memory of 3652	2432	rundll32.exe	85
PID 2432 wrote to memory of 3652	2432	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQJQSF\QQGame.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQJQSF\QQGame.dll,#1
  2⤵
  PID:3652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 568
    3⤵
    - Program crash
    PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3652 -ip 3652
1⤵
PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads