7ecfcfc4ea9e2c28f52836fb1122bf7327a77308b6bee25226967876d2ae889a

Analysis

max time kernel
31s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 17:24

Target

AnkaBotPC_4.0.5/AnkaBotPC/Application/libGLESv2.dll
Size

6.6MB
MD5

60653437bea3c98c6e3e78c1fdab2fac
SHA1

2f1aac723a6ea62edc4cd6aded4d7e83b9fd2956
SHA256

998dd8be2fa3a0b2952bedcd175649531a3820b625ee199e15b1bfd8e7991610
SHA512

0e0d3d6c9c331db0f8e664cc90182192266f654ef91b12027cbe6de9141d2306c4f9e01b4d28b99234b4a12b1f45c715852d952bde118708f8b0f0ab619aff08
SSDEEP

98304:rLhRfgQ8SnTzV0q5I4AYYIL9INmTfxBQx9lFpswnY4XBBrgodO54:rFRCSqxziL9PT5BQx8wYcgoY5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

992 1704 WerFault.exe rundll32.exe

pid	pid_target	process	target process
992	1704	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1528 wrote to memory of 1704	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1704	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1704	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1704	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1704	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1704	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1704	1528	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 992	1704	rundll32.exe	WerFault.exe
PID 1704 wrote to memory of 992	1704	rundll32.exe	WerFault.exe
PID 1704 wrote to memory of 992	1704	rundll32.exe	WerFault.exe
PID 1704 wrote to memory of 992	1704	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\libGLESv2.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 224
3⤵
- Program crash
PID:992

memory/992-56-0x0000000000000000-mapping.dmp

Download
memory/1704-54-0x0000000000000000-mapping.dmp

Download
memory/1704-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download