30fe745e9fb94f50cdf702f28218bbcd105db9e341a7f78ac9811a9fbda628f3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 17:34

Target

QQkjmfmhklq/QQ空间免费美化克隆器/Update.dll
Size

195KB
MD5

08695e17c85de603609187464915b5c6
SHA1

8f9ef5ec3415ea754117314241f34728ecebc78b
SHA256

934d516b8b86f1b8f75e349378bf8a3077405b841c69eb6a0c1fff8502e07c5c
SHA512

d8e2d136cab991c68834856f886761cd75ec257900a8201904dd33e58aad4fbfca026c2b91055ffce58ebbae3a20d9b8e03e7cdca22ed19628a77e6c4a330fe2
SSDEEP

3072:gTEmHeQOTwvrHwPVSGkK9/W+WloA7suALs7cPNwysge6fpapXeNcXZDDY:RaeQ3rQtSG79eOBLNnRat0cBDY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2708	1880	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1040 wrote to memory of 1880	1040	rundll32.exe	28
PID 1880 wrote to memory of 2708	1880	rundll32.exe	29
PID 1880 wrote to memory of 2708	1880	rundll32.exe	29
PID 1880 wrote to memory of 2708	1880	rundll32.exe	29
PID 1880 wrote to memory of 2708	1880	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQkjmfmhklq\QQ空间免费美化克隆器\Update.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQkjmfmhklq\QQ空间免费美化克隆器\Update.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 244
    3⤵
    - Program crash
    PID:2708

memory/1880-0-0x0000000000240000-0x00000000002FD000-memory.dmp

Filesize
756KB

Download
memory/1880-1-0x0000000000240000-0x00000000002FD000-memory.dmp

Filesize
756KB

Download
memory/1880-3-0x00000000002CB000-0x00000000002CC000-memory.dmp

Filesize
4KB

Download
memory/1880-2-0x0000000000240000-0x00000000002FD000-memory.dmp

Filesize
756KB

Download