c760e27b4fd16ff8ddb219856ef59e1268681f53de8e266723a1b558c0f1fb8f

Analysis

max time kernel
132s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 12:33

Target

QQ飞车老鬼辅助 3.6/点此打开辅助！/plugin/FILE.dll
Size

40KB
MD5

d0f222e0927f3f0e341dca4f47af739f
SHA1

eebd84e63c3c7e7779712ead30b93ae2e93e3ed1
SHA256

9d86a5dbd2395a345675f02746127eb44d184250fd6e901c0c5876bbe4d2b167
SHA512

fa81a0729e92ed05bb8999f22b3c164d27bb8184bab60f1884290b9d15e1e9bae0656b3515a6d2a0d90747869398e159c93fe5aef405810dca2eba4124ad6061
SSDEEP

384:NG53ptguMRrpOibHXzpPtapkBAWBLjDrks5X8C3tQ7Ax4s:I5SRpLbDpPcQAMLjDrksJP3z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4048	5044	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 5044	2800	regsvr32.exe	85
PID 2800 wrote to memory of 5044	2800	regsvr32.exe	85
PID 2800 wrote to memory of 5044	2800	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\FILE.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\FILE.dll"
  2⤵
  PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 664
    3⤵
    - Program crash
    PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5044 -ip 5044
1⤵
PID:2156