871761e2556c306e5507c278fee29c3f507d4eb0efac36cb98dc432daa15784f

Resubmissions

23/04/2023, 17:07

23/04/2023, 17:03

23/04/2023, 16:56

max time kernel
83s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2023, 16:56

Target

Hexa v1.5/Hexa/Hexal.dll
Size

3.7MB
MD5

e85fedf3928c13d5a919496a4ba2a4db
SHA1

d89f8e39e7acfd63ca1e014c6c26aa159669a824
SHA256

64a2a4edaaa4a1018b9897a48cbbc2c488f253fb4482ba7e7e55b83c9bd8ff7d
SHA512

1810cff90767d15244c16c14d2e50c1fcdc6e4dfcffa8ae7f9d132df7dc229cc6cc380ebb1b3d1a7b897980a9513c25a32d626fd719f9bc947531d72faca049a
SSDEEP

98304:4npYPEZDnDDMfUF+G/d0cYVUTkq3Lzl+vk8mxQfq:2pN/DMUFdd0cYVUT33LzIvdbfq

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1780	5060	WerFault.exe	83
3248	5060	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5060	rundll32.exe
5060	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 5060	4632	rundll32.exe	83
PID 4632 wrote to memory of 5060	4632	rundll32.exe	83
PID 4632 wrote to memory of 5060	4632	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Hexa v1.5\Hexa\Hexal.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Hexa v1.5\Hexa\Hexal.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 616
    3⤵
    - Program crash
    PID:1780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 576
    3⤵
    - Program crash
    PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5060 -ip 5060
1⤵
PID:1248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5060 -ip 5060
1⤵
PID:2192

memory/5060-133-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/5060-134-0x00000000746D0000-0x0000000074F1E000-memory.dmp

Filesize
8.3MB

Download