43920a20626a75e1da4f04d7cfb399480555200543a1205615cd18e37ea188d1

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:14

Target

QQLive/Encrypt.dll
Size

14KB
MD5

1bf231fd332bd4bb456491ca2a369163
SHA1

238b9dc784000478feff017e85ca9d330ee6fa77
SHA256

ecb41f5a7c6ed3a429c9b81ddb78921040009062d6d555556d46f7e951cd0326
SHA512

cd56791b5ec7207b518d33be026417f611774a693314c1179599f80926a2c388bb3a7e65378175545875b49280f1056d21f741a42e9415d729bca2ceda227262
SSDEEP

192:4lkOCL9DohXVW3a08cQ2ccIcyLMQ03X7H6CkqhIMyowJL/8Qpkqs1Iu55+ebCfNe:8CL9DmVW33yFTMdrH67MYJLu1vPbCzdG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1924	3540	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 3540	3192	rundll32.exe	85
PID 3192 wrote to memory of 3540	3192	rundll32.exe	85
PID 3192 wrote to memory of 3540	3192	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQLive\Encrypt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQLive\Encrypt.dll,#1
  2⤵
  PID:3540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 616
    3⤵
    - Program crash
    PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3540 -ip 3540
1⤵
PID:3640