7ecfcfc4ea9e2c28f52836fb1122bf7327a77308b6bee25226967876d2ae889a

Analysis

max time kernel
27s
max time network
133s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 17:24

Target

AnkaBotPC_4.0.5/AnkaBotPC/Application/d3dcompiler_47.dll
Size

3.5MB
MD5

2f2e363c9a9baa0a9626db374cc4e8a4
SHA1

17f405e81e5fce4c5a02ca049f7bd48b31674c8f
SHA256

2630f4188bd2ea5451ca61d83869bf7068a4f0440401c949a9feb9fb476e15df
SHA512

e668a5d1f5e6f821ebfa0913e201f0dfd8da2f96605701f8db18d14ea4fdeac73aeb9b4fe1f22eaeffcdd1c0f73a6701763727d5b09775666f82b678404e4924
SSDEEP

49152:sXMoHAsisjBFjJMLhHELxJm8ZU8W/GBj5Z535TMpinAizxkl/cD11bqCG7jHbOkD:srZOb8W/G5hnAizxz7NZy9AG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1504 384 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1504	384	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 976 wrote to memory of 384	976	rundll32.exe	rundll32.exe
PID 384 wrote to memory of 1504	384	rundll32.exe	WerFault.exe
PID 384 wrote to memory of 1504	384	rundll32.exe	WerFault.exe
PID 384 wrote to memory of 1504	384	rundll32.exe	WerFault.exe
PID 384 wrote to memory of 1504	384	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\d3dcompiler_47.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\d3dcompiler_47.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 224
3⤵
- Program crash
PID:1504

memory/384-54-0x0000000000000000-mapping.dmp

Download
memory/384-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1504-56-0x0000000000000000-mapping.dmp

Download