7ecfcfc4ea9e2c28f52836fb1122bf7327a77308b6bee25226967876d2ae889a

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 17:24

Target

AnkaBotPC_4.0.5/AnkaBotPC/Application/libGLESv2.dll
Size

6.6MB
MD5

60653437bea3c98c6e3e78c1fdab2fac
SHA1

2f1aac723a6ea62edc4cd6aded4d7e83b9fd2956
SHA256

998dd8be2fa3a0b2952bedcd175649531a3820b625ee199e15b1bfd8e7991610
SHA512

0e0d3d6c9c331db0f8e664cc90182192266f654ef91b12027cbe6de9141d2306c4f9e01b4d28b99234b4a12b1f45c715852d952bde118708f8b0f0ab619aff08
SSDEEP

98304:rLhRfgQ8SnTzV0q5I4AYYIL9INmTfxBQx9lFpswnY4XBBrgodO54:rFRCSqxziL9PT5BQx8wYcgoY5

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4512 2240 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4512	2240	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2800 wrote to memory of 2240	2800	rundll32.exe	rundll32.exe
PID 2800 wrote to memory of 2240	2800	rundll32.exe	rundll32.exe
PID 2800 wrote to memory of 2240	2800	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\libGLESv2.dll,#1
2⤵
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 624
3⤵
- Program crash
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2240 -ip 2240
1⤵
PID:4744