97795d9f47bb3dd3da22290f7355947fcfe6399af5e46cb4106e965395d62d4b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 04:55

Target

$APPDATA/Tencent/QQPCMgr/Clinic/Drive_theLife_SDK/DriverTheLife20141114/appuninst.dll
Size

166KB
MD5

e3a05807f97705dbfe2c9da109944332
SHA1

46594a35e3df534f0d2067bfbbdce2c0ce409b8e
SHA256

510b59cd61bda18d407efac82f3a4cae48c1d2aa8d58e4c898fa3e88a0b09556
SHA512

09da3a7673446e77a2374f7629c01ab3b16e848dd3f3159b7635afbcb753575be31498ac39cba611530c86406e2b20c00b22bd175c96d7fb194ab6fbd5162e9f
SSDEEP

3072:q7C+/QSjR8gCjkTPfVUKK9o++kI9fZTIV0znYMU49x+rqAZtL:qn/QwR+kZJ+XI9fZTMmKv

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\log\appuninst.log	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
216	4592	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 4592	4280	rundll32.exe	83
PID 4280 wrote to memory of 4592	4280	rundll32.exe	83
PID 4280 wrote to memory of 4592	4280	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\Tencent\QQPCMgr\Clinic\Drive_theLife_SDK\DriverTheLife20141114\appuninst.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\Tencent\QQPCMgr\Clinic\Drive_theLife_SDK\DriverTheLife20141114\appuninst.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:4592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 612
    3⤵
    - Program crash
    PID:216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4592 -ip 4592
1⤵
PID:4888