c760e27b4fd16ff8ddb219856ef59e1268681f53de8e266723a1b558c0f1fb8f | Triage

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 12:33

Sharing

Report Analysis Logs

General

Target

QQ飞车老鬼辅助 3.6/点此打开辅助！/plugin/LXJ_PLUG.dll
Size

360KB
MD5

abd59db197cc7ada6ca75035c34e02c3
SHA1

95f8d1d8cc25c07483826daff77a7b23a153fda1
SHA256

2ca6d944e550e1e3d0124df48345eae5b96a60971258043c452d5a67e59ca17a
SHA512

ad5447c79c070853145bbefd55227b99500f45f7b2e41c9d918c5abc99a6f6e4c743c2b7a34dc40baaefdfea2ea7bb2537e59f06edd43dbe523c56de39537ece
SSDEEP

6144:IU2TGMjYc8www7wrJ8HEbjDdRnxuwGkKT:IPs3www7wrrjDdR0ww

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 2636	648	regsvr32.exe	90
PID 648 wrote to memory of 2636	648	regsvr32.exe	90
PID 648 wrote to memory of 2636	648	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\LXJ_PLUG.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\LXJ_PLUG.dll"
  2⤵
  PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads