df60787a0c3b400b1e61a30dc7c998131594f512e9fc43dfd6f18097ccfc55a9

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-09-2022 20:11

Target

bhaks.dll
Size

2.8MB
MD5

423ad8cdb5c51a3486c7eb5fb9b72816
SHA1

64ed16216926c2348ad2ef1125fa063dc7e075d0
SHA256

0f2c4a96f3d63ee582adc36ac2c8c95dfacab53a1a61a49a8b7de8e8d3e50185
SHA512

d341c546a46fec6368121984407c9a770071b997f7a264413dd101d327a8de0944bc447b172c3fed703fa510ce0557eb6045f82d61606b2f66d36aa569f5fa6b
SSDEEP

24576:5W59BWsG5R3lVLFM9uyxBzkucmWxD//1wpIDbrWoKJHw2tcbT+d/zvkav6ISYtEZ:569cFNlSYXeqyYav63iEHMvjvOQK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
340	1836	WerFault.exe	21

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 340	1836	rundll32.exe	27
PID 1836 wrote to memory of 340	1836	rundll32.exe	27
PID 1836 wrote to memory of 340	1836	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bhaks.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1836 -s 84
  2⤵
  - Program crash
  PID:340