本帖最后由 c/mm 于 2018-8-17 19:38 编辑
蜘蛛MISS
双击拦截
Preventive Protection event: Inject to protected/system process
sid: S-1-5-21-839627113-1048685324-2973982688-1001, cid: 1816/5172:\Device\HarddiskVolume3\Users\\Desktop\111\刺激战场方框透视.exe
context: start addr: 0x77b5a0, image: 0x400000:\Device\HarddiskVolume3\Users\Desktop\111\刺激战场方框透视.exe
hips: type: 18, action: deny [5]
curdir: C:\Users\\Desktop\111\, cmd: "C:\Users\\Desktop\111\刺激战场方框透视.exe"
fileinfo: size: 1716224, easize: 40, attr: 0x20, buildtime: 20.07.2018 17:48:31.000, ctime: 17.08.2018 19:25:35.220, atime: 17.08.2018 19:25:49.300, mtime: 20.07.2018 17:50:16.017, descr: 易语言程序, ver: 1.0.0.0, company: , oname:
hash: eafcfbc8194dcd198a3bec9154ae97ff02bef4f2 status: unsigned, pe32, new_pe / unsigned / unknown / unknown
inject: ChangeThreadContext [2], flags: 0x0, start addr: 0x0, addr: 0x0, param: 0x0, len: 0, target: bitness: 32, init: 0, image: \Device\HarddiskVolume3\Windows\SysWOW64\cmd.exe:5412
fileinfo: size: 232960, easize: 248, attr: 0x20, buildtime: 0, ctime: 12.04.2018 07:34:49.167, atime: 17.08.2018 16:32:17.622, mtime: 12.04.2018 07:34:49.167, descr: Windows Command Processor, ver: 10.0.17134.1 (WinBuild.160101.0800), company: Microsoft Corporation, oname: Cmd.Exe
status: signed_microsoft, script_vm / signed_microsoft / clean / cmd
threat: DPH:Trojan.Inject.2.0 ==> send user blocked alert
path: \Device\HarddiskVolume3\Users\Desktop\111\刺激战场方框透视.exe ==> denied access to file
process: \Device\HarddiskVolume3\Users\Desktop\111\刺激战场方框透视.exe:1816 ==> suspended all threads in process
path: \Device\HarddiskVolume3\Users\Desktop\111\刺激战场方框透视.exe ==> quarantined
send driver event reply for unblock process ==> success
disinfect: \Device\HarddiskVolume3\Users\Desktop\111\刺激战场方框透视.exe ==> quarantined [8]
threat: DPH:Trojan.Inject.2.0 ==> sended user virus found alert
analyze object behavior and find traces:
can't find traces for object: \Device\HarddiskVolume3\Users\Desktop\111\刺激战场方框透视.exe
process: \Device\HarddiskVolume3\Windows\SysWOW64\cmd.exe:5412 ==> suspended all threads in process
process: \Device\HarddiskVolume3\Windows\SysWOW64\cmd.exe:5412 ==> terminated
send user blocked alert
|
发表于 2018-8-17 16:59:03
楼主
