491a7743e26ecbf89e9e9e7bb79118c3986efaa20babaf17ba31bc832bee8b97

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:06

Target

GSBOT cracked/GSBOT cracked.dll
Size

279KB
MD5

01c6d665e3d982964126895c7dd81118
SHA1

b6bc2ac01c7578f69dc29f8d286f57dbda03921f
SHA256

83efbacfd6b18b6dc5235acc6c1763a22a7fa37970f52b91c328d2cd544f38ab
SHA512

75435a3bcd01509efb41d07e8a575a0655d0007eecae5640a9970be3c27c9493d664e790df25e903e5de25ad8429f3273506523f621d90748f28ffa2cbcca38b
SSDEEP

6144:coW857PmTwTBvYx8LfxvRAu+5N2RCDcIs3aCwTKR:PvDjNRAuuUbIs3Su

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	2056	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2056	2372	rundll32.exe	28
PID 2372 wrote to memory of 2056	2372	rundll32.exe	28
PID 2372 wrote to memory of 2056	2372	rundll32.exe	28
PID 2372 wrote to memory of 2056	2372	rundll32.exe	28
PID 2372 wrote to memory of 2056	2372	rundll32.exe	28
PID 2372 wrote to memory of 2056	2372	rundll32.exe	28
PID 2372 wrote to memory of 2056	2372	rundll32.exe	28
PID 2056 wrote to memory of 2960	2056	rundll32.exe	29
PID 2056 wrote to memory of 2960	2056	rundll32.exe	29
PID 2056 wrote to memory of 2960	2056	rundll32.exe	29
PID 2056 wrote to memory of 2960	2056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\GSBOT cracked\GSBOT cracked.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\GSBOT cracked\GSBOT cracked.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 380
    3⤵
    - Program crash
    PID:2960