7ecfcfc4ea9e2c28f52836fb1122bf7327a77308b6bee25226967876d2ae889a

Analysis

max time kernel
90s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 17:24

Target

AnkaBotPC_4.0.5/AnkaBotPC/Application/vulkan-1.dll
Size

625KB
MD5

b8d0b24728bedf214c03c7fa3c965288
SHA1

0adc498ef988e8b6c4e73d73ea598f6bdde312cb
SHA256

dffe70c5680fb5774a95c66d573783d71db1702a77ca70a492422f9044a70bbe
SHA512

0bc9bb7385fb6d0993fb0b5800b3f3fdbeb6ff464b95b67a79d8054787368837202f280151bd4a16eaabccca94366b76d17f3f929458dca69f4a5da79f06df5f
SSDEEP

12288:EaVMRz3jmXRLQ1RtGt5Rp9CR3mv7v2QUsKrSuKMeEut6Bhnj:rVgzzmmm7v31QEah

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4828 4396 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4828	4396	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4956 wrote to memory of 4396	4956	rundll32.exe	rundll32.exe
PID 4956 wrote to memory of 4396	4956	rundll32.exe	rundll32.exe
PID 4956 wrote to memory of 4396	4956	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\vulkan-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AnkaBotPC_4.0.5\AnkaBotPC\Application\vulkan-1.dll,#1
2⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 620
3⤵
- Program crash
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4396 -ip 4396
1⤵
PID:4744