7ecfcfc4ea9e2c28f52836fb1122bf7327a77308b6bee25226967876d2ae889a

Analysis

max time kernel
33s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 17:24

Target

AnkaBotPC_4.0.5/AnkaBotPC/Application/swiftshader/libEGL.dll
Size

364KB
MD5

62e089dae9086a3b14f230b2fffd702f
SHA1

c8baf039890b309be0d66ca1e661a4681e47ddd3
SHA256

31c34e3bb5b57101ecc83c6ad153e811ad4e6d18f64c6bc5f9ea15263a550ac2
SHA512

644428b1c51e3ec8263e938abbab820e36af2eb8618c924037ac1a67bae394c54603f8f981bf7853679213837ead16f8d41dcbcf0da25a5ab0bc87fdad92448a
SSDEEP

6144:B4vgaNrFwjONtiVw4LVxz3jbIHupKDdheV+FE+liWSsI4:B4vgcrWONtiVxQupKJhj

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 904 wrote to memory of 1756	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1756	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1756	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1756	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1756	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1756	904	rundll32.exe	rundll32.exe
PID 904 wrote to memory of 1756	904	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\swiftshader\libEGL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\swiftshader\libEGL.dll,#1
2⤵
PID:1756

memory/1756-54-0x0000000000000000-mapping.dmp

Download
memory/1756-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download