871761e2556c306e5507c278fee29c3f507d4eb0efac36cb98dc432daa15784f

Resubmissions

23-04-2023 17:07

23-04-2023 17:03

23-04-2023 16:56

max time kernel
65s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2023 17:07

Target

Hexa v1.5/Hexa/Hexal.dll
Size

3.7MB
MD5

e85fedf3928c13d5a919496a4ba2a4db
SHA1

d89f8e39e7acfd63ca1e014c6c26aa159669a824
SHA256

64a2a4edaaa4a1018b9897a48cbbc2c488f253fb4482ba7e7e55b83c9bd8ff7d
SHA512

1810cff90767d15244c16c14d2e50c1fcdc6e4dfcffa8ae7f9d132df7dc229cc6cc380ebb1b3d1a7b897980a9513c25a32d626fd719f9bc947531d72faca049a
SSDEEP

98304:4npYPEZDnDDMfUF+G/d0cYVUTkq3Lzl+vk8mxQfq:2pN/DMUFdd0cYVUT33LzIvdbfq

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1440	368	WerFault.exe	85
4116	368	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
368	rundll32.exe
368	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 368	4768	rundll32.exe	85
PID 4768 wrote to memory of 368	4768	rundll32.exe	85
PID 4768 wrote to memory of 368	4768	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Hexa v1.5\Hexa\Hexal.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Hexa v1.5\Hexa\Hexal.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 616
    3⤵
    - Program crash
    PID:1440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 584
    3⤵
    - Program crash
    PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 368 -ip 368
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 368 -ip 368
1⤵
PID:4456

memory/368-133-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/368-134-0x0000000074710000-0x0000000074F5E000-memory.dmp

Filesize
8.3MB

Download