871761e2556c306e5507c278fee29c3f507d4eb0efac36cb98dc432daa15784f

Resubmissions

23/04/2023, 17:07

23/04/2023, 17:03

23/04/2023, 16:56

max time kernel
47s
max time network
72s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
23/04/2023, 17:03

Target

Hexa v1.5/Hexa/Hexal.dll
Size

3.7MB
MD5

e85fedf3928c13d5a919496a4ba2a4db
SHA1

d89f8e39e7acfd63ca1e014c6c26aa159669a824
SHA256

64a2a4edaaa4a1018b9897a48cbbc2c488f253fb4482ba7e7e55b83c9bd8ff7d
SHA512

1810cff90767d15244c16c14d2e50c1fcdc6e4dfcffa8ae7f9d132df7dc229cc6cc380ebb1b3d1a7b897980a9513c25a32d626fd719f9bc947531d72faca049a
SSDEEP

98304:4npYPEZDnDDMfUF+G/d0cYVUTkq3Lzl+vk8mxQfq:2pN/DMUFdd0cYVUT33LzIvdbfq

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2424	1900	WerFault.exe	66
2556	1900	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1900	rundll32.exe
1900	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 1900	1820	rundll32.exe	66
PID 1820 wrote to memory of 1900	1820	rundll32.exe	66
PID 1820 wrote to memory of 1900	1820	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Hexa v1.5\Hexa\Hexal.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Hexa v1.5\Hexa\Hexal.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 632
    3⤵
    - Program crash
    PID:2424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 580
    3⤵
    - Program crash
    PID:2556

memory/1900-121-0x0000000001060000-0x0000000001061000-memory.dmp

Filesize
4KB

Download
memory/1900-122-0x00000000738E0000-0x000000007412E000-memory.dmp

Filesize
8.3MB

Download