1205de65f89bd837ee24b30f91fa863da3a3038bf6e6d77b24be8765f584ec99

Analysis

max time kernel
111s
max time network
346s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2023, 03:53

Target

Big hacker official tool v69 64bit.exe/CefSharp.BrowserSubprocess.Core.dll
Size

1.1MB
MD5

db989110036d0cf6319419d75b245038
SHA1

a0e29ef04e1343b4e5b5e6f8734dd8f16a5e955e
SHA256

44dc69b7fb559856982774f3450ff0d5da494851d971269f45d9f33fedef5fd4
SHA512

ef5b69abc4ddf1c3d956f9b562284a6e4df4b3cafa5ebc7353a6f3ca5114125ab315e4c87bca7d87657ca7a2f897de89d754d8a9c048bdc73ba61df432a3b79d
SSDEEP

24576:vlXWLZ2fd0MVGic0/fY93fUF//VfiO0SQtz9F8w9AY0mgxwCX2ZiV2hEDssQjPco:vlXWLxxltv8w9AY0mgxwCX2ZiV2hEDsr

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2120	1852	WerFault.exe	79
4996	1852	WerFault.exe	79

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2120	1852	rundll32.exe	83
PID 1852 wrote to memory of 2120	1852	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Big hacker official tool v69 64bit.exe\CefSharp.BrowserSubprocess.Core.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1852 -s 1144
  2⤵
  - Program crash
  PID:2120
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1852 -s 1144
  2⤵
  - Program crash
  PID:4996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 1852 -ip 1852
1⤵
PID:1184

memory/1852-132-0x0000018D51FA0000-0x0000018D520A0000-memory.dmp

Filesize
1024KB

Download
memory/1852-133-0x00007FFDA3B90000-0x00007FFDA4651000-memory.dmp

Filesize
10.8MB

Download
memory/1852-134-0x0000018D51FA0000-0x0000018D520A0000-memory.dmp

Filesize
1024KB

Download
memory/1852-135-0x00007FFDA3B90000-0x00007FFDA4651000-memory.dmp

Filesize
10.8MB

Download
memory/1852-137-0x00007FFDA3B90000-0x00007FFDA4651000-memory.dmp

Filesize
10.8MB

Download