2be644cec6f2caf1ddf4e404d2b381c933b926b4d90337230f42013c0b9c7ffa

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09-02-2024 09:30

Target

pikabot.dll
Size

731KB
MD5

557de697a1edffc6186a399975b4d52e
SHA1

add23b100d7777dc91f09e80696b1b91d4d3d467
SHA256

2f8254fe651cf750b0ca28a83c1f430857a7981c5a2f0cd220b4ce96a1aa1d6c
SHA512

7855990e4adb7ec8c01d5b623c2ae0aafae5e9908cba0ea9bc20ad9152800627f95c8b6ac27ba2780e6150e93510ce903684a0f285418fe9a439efcd69a5fbce
SSDEEP

12288:L88tpQmNwfp6/dNE2uIigUp+CQ/EAr06DggYmpEj7N904+G5ciTHMgxiQt1cb:Q8PQGwB6/IRgTEoDg6pEj7N94G5BTHx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
220	1080	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 1080	4872	rundll32.exe	83
PID 4872 wrote to memory of 1080	4872	rundll32.exe	83
PID 4872 wrote to memory of 1080	4872	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pikabot.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\pikabot.dll,#1
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 636
    3⤵
    - Program crash
    PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1080 -ip 1080
1⤵
PID:3736