c760e27b4fd16ff8ddb219856ef59e1268681f53de8e266723a1b558c0f1fb8f

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 12:33

Target

QQ飞车老鬼辅助 3.6/点此打开辅助！/plugin/MSG.dll
Size

40KB
MD5

3f92f9c3ac33dcf97741eb937c3e7c44
SHA1

8c950edebb7749dc5939fd2841a1a81d2809ed68
SHA256

417172e573177c921715ade25a63909ca986e11e16c3858ec0ef327c3d65355b
SHA512

5c32833e48dd6e4f8b0073d7d23e0342e00d94e460bfd83d51087dafbf0706f7e255c1458155690b223310cb4b0a6bd3afbccdedc9ea13ecacc6ff6e28eb6a23
SSDEEP

384:GEkt05A3HUNImsuw0h/g2WMbMFGc6DJz9u9IFy9ILiTnuozMh+rRL+GhD8sQI7Nm:rA30NIfobNn9uBDT5RrB+GhD8yK1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3484	1344	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1344	784	regsvr32.exe	82
PID 784 wrote to memory of 1344	784	regsvr32.exe	82
PID 784 wrote to memory of 1344	784	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\MSG.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\MSG.dll"
  2⤵
  PID:1344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 624
    3⤵
    - Program crash
    PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1344 -ip 1344
1⤵
PID:3064