43920a20626a75e1da4f04d7cfb399480555200543a1205615cd18e37ea188d1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:14

Target

QQLive/ExceptCatch.dll
Size

93KB
MD5

4c5a7c55612f47ea7116dab10a2f6013
SHA1

efe7d6a13f1173d7022a1b68e5f7a306a719414f
SHA256

c4ec6348b345494097f3d84379a1916d0fa22c07943c238875e2d45e215935b1
SHA512

9c8767bd89625f47b17b662bf9baa7deb1902defca86aed5a6fa98c67590753bc8598424b9e7876cd7a10d86f5f533266634e6a8b8fc05b603fafe9f720f62fd
SSDEEP

1536:Hq0wPY0p2L1QwllwV122XfsXcvGlGJ9sreOX5OgaIJYfMXIRya7CYY:HqJPY0p2iwlCZsXgGisrDOgaIJTXkbS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3428	3160	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 3160	1392	rundll32.exe	84
PID 1392 wrote to memory of 3160	1392	rundll32.exe	84
PID 1392 wrote to memory of 3160	1392	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQLive\ExceptCatch.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\QQLive\ExceptCatch.dll,#1
  2⤵
  PID:3160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 664
    3⤵
    - Program crash
    PID:3428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3160 -ip 3160
1⤵
PID:3248