c760e27b4fd16ff8ddb219856ef59e1268681f53de8e266723a1b558c0f1fb8f

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 12:33

Target

QQ飞车老鬼辅助 3.6/点此打开辅助！/plugin/FILE.dll
Size

40KB
MD5

d0f222e0927f3f0e341dca4f47af739f
SHA1

eebd84e63c3c7e7779712ead30b93ae2e93e3ed1
SHA256

9d86a5dbd2395a345675f02746127eb44d184250fd6e901c0c5876bbe4d2b167
SHA512

fa81a0729e92ed05bb8999f22b3c164d27bb8184bab60f1884290b9d15e1e9bae0656b3515a6d2a0d90747869398e159c93fe5aef405810dca2eba4124ad6061
SSDEEP

384:NG53ptguMRrpOibHXzpPtapkBAWBLjDrks5X8C3tQ7Ax4s:I5SRpLbDpPcQAMLjDrksJP3z

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1048	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1048	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1048	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1048	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1048	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1048	1664	regsvr32.exe	28
PID 1664 wrote to memory of 1048	1664	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\FILE.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\FILE.dll"
  2⤵
  PID:1048