c760e27b4fd16ff8ddb219856ef59e1268681f53de8e266723a1b558c0f1fb8f

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 12:33

Target

QQ飞车老鬼辅助 3.6/点此打开辅助！/plugin/DBSOFT.dll
Size

583KB
MD5

2fefa90be80337deaaec147410418302
SHA1

01577a10bde6e09af97e4ab50b99c52e49fe4bab
SHA256

afcd0defb39c2ec0ca6c923742a9aa1a25e085de0e96514838e04f13969e0daa
SHA512

e484b0b6119a08d73c2072b13cc921974a1a88794e2fed0eb0b13ee7f0b5443e0852223127b21c053a72ca8ec784b1731b8fea26dd594f862017844417d59b9c
SSDEEP

12288:7WC+Q/rDKYDu0H08Cg/2vjJY+TBvGu/fWSUXP2SoSJwN:7sQ/ikua08CgObJlBeu/fWS0umwN

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral14/memory/1808-0-0x0000000011000000-0x00000000112A5000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1808	1988	regsvr32.exe	82
PID 1988 wrote to memory of 1808	1988	regsvr32.exe	82
PID 1988 wrote to memory of 1808	1988	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\DBSOFT.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\DBSOFT.dll"
  2⤵
  PID:1808

memory/1808-0-0x0000000011000000-0x00000000112A5000-memory.dmp

Filesize
2.6MB

Download