c760e27b4fd16ff8ddb219856ef59e1268681f53de8e266723a1b558c0f1fb8f

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 12:33

Target

QQ飞车老鬼辅助 3.6/点此打开辅助！/plugin/BKGND.dll
Size

40KB
MD5

7ad9d5d752c8c5ff176a6a4fc517f734
SHA1

7b2c7aad9c52ce294bc33fc9616c4658f6aa76d0
SHA256

e53d1a4e86cf01416b1a005dd2904126fb66fc146697e3b82007dde570a04565
SHA512

ab0a13a6cdd77115bf34b28566b1ec8c2508e01619f414ad5e9af7d9c9cd93492c0426effa9a0b6a0414577e4285d3bdbdde3741b253c8f66f0d4b62f2f5f516
SSDEEP

384:8gR2trrdaeOsE0zZljveSKGtd1Db1+/favDjGSlRm/yblOgCJ:8ptrJDEuZJ2SKGtfDY/faVR+1t

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2736	2612	regsvr32.exe	28
PID 2612 wrote to memory of 2736	2612	regsvr32.exe	28
PID 2612 wrote to memory of 2736	2612	regsvr32.exe	28
PID 2612 wrote to memory of 2736	2612	regsvr32.exe	28
PID 2612 wrote to memory of 2736	2612	regsvr32.exe	28
PID 2612 wrote to memory of 2736	2612	regsvr32.exe	28
PID 2612 wrote to memory of 2736	2612	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\BKGND.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\BKGND.dll"
  2⤵
  PID:2736