30fe745e9fb94f50cdf702f28218bbcd105db9e341a7f78ac9811a9fbda628f3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 17:34

Target

QQkjmfmhklq/QQ空间免费美化克隆器/Update.dll
Size

195KB
MD5

08695e17c85de603609187464915b5c6
SHA1

8f9ef5ec3415ea754117314241f34728ecebc78b
SHA256

934d516b8b86f1b8f75e349378bf8a3077405b841c69eb6a0c1fff8502e07c5c
SHA512

d8e2d136cab991c68834856f886761cd75ec257900a8201904dd33e58aad4fbfca026c2b91055ffce58ebbae3a20d9b8e03e7cdca22ed19628a77e6c4a330fe2
SSDEEP

3072:gTEmHeQOTwvrHwPVSGkK9/W+WloA7suALs7cPNwysge6fpapXeNcXZDDY:RaeQ3rQtSG79eOBLNnRat0cBDY

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	4368	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4368	4440	rundll32.exe	84
PID 4440 wrote to memory of 4368	4440	rundll32.exe	84
PID 4440 wrote to memory of 4368	4440	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQkjmfmhklq\QQ空间免费美化克隆器\Update.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQkjmfmhklq\QQ空间免费美化克隆器\Update.dll,#1
  2⤵
  PID:4368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 636
    3⤵
    - Program crash
    PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4368 -ip 4368
1⤵
PID:2232

memory/4368-0-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4368-2-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download
memory/4368-1-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/4368-3-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download