Analysis

  • max time kernel
    134s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-02-2023 17:24

General

  • Target

    AnkaBotPC_4.0.5/AnkaBotPC/Application/swiftshader/libEGL.dll

  • Size

    364KB

  • MD5

    62e089dae9086a3b14f230b2fffd702f

  • SHA1

    c8baf039890b309be0d66ca1e661a4681e47ddd3

  • SHA256

    31c34e3bb5b57101ecc83c6ad153e811ad4e6d18f64c6bc5f9ea15263a550ac2

  • SHA512

    644428b1c51e3ec8263e938abbab820e36af2eb8618c924037ac1a67bae394c54603f8f981bf7853679213837ead16f8d41dcbcf0da25a5ab0bc87fdad92448a

  • SSDEEP

    6144:B4vgaNrFwjONtiVw4LVxz3jbIHupKDdheV+FE+liWSsI4:B4vgcrWONtiVxQupKJhj

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\swiftshader\libEGL.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\swiftshader\libEGL.dll,#1
      2⤵
        PID:4604

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4604-132-0x0000000000000000-mapping.dmp