7ecfcfc4ea9e2c28f52836fb1122bf7327a77308b6bee25226967876d2ae889a

Analysis

max time kernel
15s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 17:24

Target

AnkaBotPC_4.0.5/AnkaBotPC/Application/libEGL.dll
Size

349KB
MD5

8f175c85cd7a0d670855d118a8008e2e
SHA1

e645802fe45b27e8b6ac244d143bc39e17342bd1
SHA256

9ef06071c0deb115c7b433496b1ffda1c603b502298e4ce714818c67866c6e78
SHA512

152fec689f4d886eaed52202213250516c99ddc8019aea1106a2aca4eba6a51f3f9bad8e98bb65bb9293105b10ff5882fa79861ba6b8b4eb6922678c463471f5
SSDEEP

6144:fEYlqgyp/a1fn9F3bsyy/0oTv1eqMuQ/4RQpV5+eMHm+Kii:fEYlryp/M3bsyyb7SuQ/WQJhb

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1304 wrote to memory of 1444	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1444	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1444	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1444	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1444	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1444	1304	rundll32.exe	rundll32.exe
PID 1304 wrote to memory of 1444	1304	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\libEGL.dll,#1
2⤵
PID:1444

memory/1444-54-0x0000000000000000-mapping.dmp

Download
memory/1444-55-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download