c760e27b4fd16ff8ddb219856ef59e1268681f53de8e266723a1b558c0f1fb8f

Analysis

max time kernel
141s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 12:33

Target

QQ飞车老鬼辅助 3.6/点此打开辅助！/plugin/BKGND.dll
Size

40KB
MD5

7ad9d5d752c8c5ff176a6a4fc517f734
SHA1

7b2c7aad9c52ce294bc33fc9616c4658f6aa76d0
SHA256

e53d1a4e86cf01416b1a005dd2904126fb66fc146697e3b82007dde570a04565
SHA512

ab0a13a6cdd77115bf34b28566b1ec8c2508e01619f414ad5e9af7d9c9cd93492c0426effa9a0b6a0414577e4285d3bdbdde3741b253c8f66f0d4b62f2f5f516
SSDEEP

384:8gR2trrdaeOsE0zZljveSKGtd1Db1+/favDjGSlRm/yblOgCJ:8ptrJDEuZJ2SKGtfDY/faVR+1t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	4360	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 4360	2200	regsvr32.exe	82
PID 2200 wrote to memory of 4360	2200	regsvr32.exe	82
PID 2200 wrote to memory of 4360	2200	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\BKGND.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\BKGND.dll"
  2⤵
  PID:4360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 624
    3⤵
    - Program crash
    PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4360 -ip 4360
1⤵
PID:2180