10273efcac023d59fc68901d4d4fcf3ca59858fbca92ffb81243ccd49784218d

Analysis

max time kernel
139s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 16:07

Target

GDHM_TASBOT_v35.6/RoastedMarshmellow.dll
Size

131KB
MD5

a16c532bc31d194b37f9d3279cca776b
SHA1

33eceb271aedb99fb6fe04adca2511b2343c2433
SHA256

8c36befca2a0ad82ffadc442bd6391bed8fcf855a398f3a8652332d087cf2afe
SHA512

9454dacaae91fd81786c8608a4af04fe67058eb7590c99a4bf7386ca1e0c7621cfbd20333cce9ebeb6bb9e1fb0d9acc1726640a95e7b2c16b95821e1686606b3
SSDEEP

3072:ArvdOcLB3FRvxIPHx/BNR//ct+NU5HMJXWHl4Y2pmnoQVHsMlBB:HyvkVFq61XSMQX

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1356 5044 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1356	5044	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2276 wrote to memory of 5044	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 5044	2276	rundll32.exe	rundll32.exe
PID 2276 wrote to memory of 5044	2276	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\RoastedMarshmellow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GDHM_TASBOT_v35.6\RoastedMarshmellow.dll,#1
2⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 604
3⤵
- Program crash
PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5044 -ip 5044
1⤵
PID:428

memory/5044-133-0x0000000074BB0000-0x0000000074C01000-memory.dmp

Filesize
324KB

Download