0d13dd9df82ec9d8b778815ae9634d8ab63a1facd76de25d406e33aa44b0aecf

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 12:54

Target
$PROGRAMFILES/Tencent/QZoneMusic/$_24_/npQzoneMusic.dll
Size 151KB
Sample240601-p5e7cade87
SHA256 3bc2ac947b223e780aa24fbca81ddac6a787b8676467d7f262c119fdac9596a7
MD5 0de6a20935af7f3d4d5b291f887dcbdb
SHA1 c573828c85bfe571d84672fb985550ece1a5a92c
SHA512 34d4833ef328fc882a0cf7ef60dcfe14d4361ce27812bbbfa26f9ea0abc3d5a17cbe42ab5dd7dfc7fa94fd351eaf94555ff0a2e5d63a61e13fdd27405573159c
SSDEEP 3072:g7/7JDBWfQjJvXjp3upkHnjA9WNUYwTZ1nUoINDMOgunzHIVbDN:W7PWfQjJvTdujIl0QMOgu6P
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1608	1772	regsvr32.exe	84
PID 1772 wrote to memory of 1608	1772	regsvr32.exe	84
PID 1772 wrote to memory of 1608	1772	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Tencent\QZoneMusic\$_24_\npQzoneMusic.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Tencent\QZoneMusic\$_24_\npQzoneMusic.dll
  2⤵
  PID:1608