c760e27b4fd16ff8ddb219856ef59e1268681f53de8e266723a1b558c0f1fb8f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 12:33

Target

QQ飞车老鬼辅助 3.6/点此打开辅助！/plugin/WINDOW.dll
Size

44KB
MD5

4c462a5ff18e333b767ea44c318c05c2
SHA1

eb0f1bcd62382d4320532b330abf5cbdddd4a409
SHA256

efda60b95d43a51e54cf9f44278f36d1717e21c78686fa2157395b5635951b41
SHA512

11a8b2ee9e2b8431ddb81bbc3fa3bb596f9e2e11360f99b649017332c3b93eaa2efe105a2045285822e6d62663dec68b1c0d2a8a863f03fcec40cf04172d7139
SSDEEP

384:x3HTWhA1JTdS9XzugUBzutX4ut2mX1rNYGFyYVeYcDPDHp3BnH:x3mA1rUulBKtLt2mX1rNnyHYcDPDn

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2132	2296	regsvr32.exe	28
PID 2296 wrote to memory of 2132	2296	regsvr32.exe	28
PID 2296 wrote to memory of 2132	2296	regsvr32.exe	28
PID 2296 wrote to memory of 2132	2296	regsvr32.exe	28
PID 2296 wrote to memory of 2132	2296	regsvr32.exe	28
PID 2296 wrote to memory of 2132	2296	regsvr32.exe	28
PID 2296 wrote to memory of 2132	2296	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\WINDOW.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\QQ飞车老鬼辅助 3.6\点此打开辅助！\plugin\WINDOW.dll"
  2⤵
  PID:2132