7ecfcfc4ea9e2c28f52836fb1122bf7327a77308b6bee25226967876d2ae889a

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 17:24

Target

AnkaBotPC_4.0.5/AnkaBotPC/Application/vk_swiftshader.dll
Size

3.8MB
MD5

81397b536d1d5ff570cdb4d87993ebf0
SHA1

b15d68cfaca9f54fb6599d1b605ead86b56b08f8
SHA256

a624e33f723db0c4aabcfa4344318d90615ae273f420a6a81ce101e8ae57fd20
SHA512

0c236b1b05c9739a367e8bbdf813b8ad6773c848ee3e89c4e2bbb3572c24e1950a8e111d051baac9fe4f344bd50ff5c2a890a33de70f805b9eca18bc378f3073
SSDEEP

49152:fOzU7TubRexXiL+i34UD80vXI6sZLAt6NC5UpHWkmYIYqu3Zq9kbHWicFSBqCzLY:fAUUKivD8Ep894oS1GrBD3M

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1524 1492 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1524	1492	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3216 wrote to memory of 1492	3216	rundll32.exe	rundll32.exe
PID 3216 wrote to memory of 1492	3216	rundll32.exe	rundll32.exe
PID 3216 wrote to memory of 1492	3216	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\vk_swiftshader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3216

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\vk_swiftshader.dll,#1
2⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 600
3⤵
- Program crash
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1492 -ip 1492
1⤵
PID:5088