7ecfcfc4ea9e2c28f52836fb1122bf7327a77308b6bee25226967876d2ae889a

Analysis

max time kernel
29s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 17:24

Target

AnkaBotPC_4.0.5/AnkaBotPC/Application/vulkan-1.dll
Size

625KB
MD5

b8d0b24728bedf214c03c7fa3c965288
SHA1

0adc498ef988e8b6c4e73d73ea598f6bdde312cb
SHA256

dffe70c5680fb5774a95c66d573783d71db1702a77ca70a492422f9044a70bbe
SHA512

0bc9bb7385fb6d0993fb0b5800b3f3fdbeb6ff464b95b67a79d8054787368837202f280151bd4a16eaabccca94366b76d17f3f929458dca69f4a5da79f06df5f
SSDEEP

12288:EaVMRz3jmXRLQ1RtGt5Rp9CR3mv7v2QUsKrSuKMeEut6Bhnj:rVgzzmmm7v31QEah

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1616 1620 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1616	1620	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1064 wrote to memory of 1620	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1620	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1620	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1620	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1620	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1620	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 1620	1064	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1616	1620	rundll32.exe	WerFault.exe
PID 1620 wrote to memory of 1616	1620	rundll32.exe	WerFault.exe
PID 1620 wrote to memory of 1616	1620	rundll32.exe	WerFault.exe
PID 1620 wrote to memory of 1616	1620	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\vulkan-1.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 224
3⤵
- Program crash
PID:1616

memory/1616-56-0x0000000000000000-mapping.dmp

Download
memory/1620-54-0x0000000000000000-mapping.dmp

Download
memory/1620-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download