7ecfcfc4ea9e2c28f52836fb1122bf7327a77308b6bee25226967876d2ae889a

Analysis

max time kernel
32s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 17:24

Target

AnkaBotPC_4.0.5/AnkaBotPC/Application/vk_swiftshader.dll
Size

3.8MB
MD5

81397b536d1d5ff570cdb4d87993ebf0
SHA1

b15d68cfaca9f54fb6599d1b605ead86b56b08f8
SHA256

a624e33f723db0c4aabcfa4344318d90615ae273f420a6a81ce101e8ae57fd20
SHA512

0c236b1b05c9739a367e8bbdf813b8ad6773c848ee3e89c4e2bbb3572c24e1950a8e111d051baac9fe4f344bd50ff5c2a890a33de70f805b9eca18bc378f3073
SSDEEP

49152:fOzU7TubRexXiL+i34UD80vXI6sZLAt6NC5UpHWkmYIYqu3Zq9kbHWicFSBqCzLY:fAUUKivD8Ep894oS1GrBD3M

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

544 1680 WerFault.exe rundll32.exe

pid	pid_target	process	target process
544	1680	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 900 wrote to memory of 1680	900	rundll32.exe	rundll32.exe
PID 1680 wrote to memory of 544	1680	rundll32.exe	WerFault.exe
PID 1680 wrote to memory of 544	1680	rundll32.exe	WerFault.exe
PID 1680 wrote to memory of 544	1680	rundll32.exe	WerFault.exe
PID 1680 wrote to memory of 544	1680	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\vk_swiftshader.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 224
3⤵
- Program crash
PID:544

memory/544-56-0x0000000000000000-mapping.dmp

Download
memory/1680-54-0x0000000000000000-mapping.dmp

Download
memory/1680-55-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download