1c0b9425bb2f4e39eb64cae968fc3c9ea83f9067dd95db6adb616e7d7f71f322

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01-11-2023 00:27

Target

ConsoleMD/Retro/ConsoleMDBuss32.dll
Size

137KB
MD5

ed5da78366a07bf969b5c85c4c17d538
SHA1

792390c765c5d95d3f63f5923fa33eb62e9e7a6d
SHA256

f1e94367ff95b632d85353fa3da8923dc2c01112e8d6ef47fa99df19bbfd0ced
SHA512

2c201fb2b5ce5456499751541e955d98e2e8f9ec523afa1d07dea502400880398e18435bc3929a64a0ddaf8e3414030e32cfa359c63f20e06be3a4746bd004c1
SSDEEP

3072:AFICxyQPDCxkmCryY18aDAg0FulBN+qNDZGrSvg+g2:SCxkmB0AOLZDZUCg2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	2268	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2268	2096	rundll32.exe	28
PID 2096 wrote to memory of 2268	2096	rundll32.exe	28
PID 2096 wrote to memory of 2268	2096	rundll32.exe	28
PID 2096 wrote to memory of 2268	2096	rundll32.exe	28
PID 2096 wrote to memory of 2268	2096	rundll32.exe	28
PID 2096 wrote to memory of 2268	2096	rundll32.exe	28
PID 2096 wrote to memory of 2268	2096	rundll32.exe	28
PID 2268 wrote to memory of 2200	2268	rundll32.exe	29
PID 2268 wrote to memory of 2200	2268	rundll32.exe	29
PID 2268 wrote to memory of 2200	2268	rundll32.exe	29
PID 2268 wrote to memory of 2200	2268	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConsoleMD\Retro\ConsoleMDBuss32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConsoleMD\Retro\ConsoleMDBuss32.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 224
    3⤵
    - Program crash
    PID:2200