840a609768429c36b8a40d607c15455b1faa0f8f424ccb56dea8160d84bab909

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 22:03

Target

840a609768429c36b8a40d607c15455b1faa0f8f424ccb56dea8160d84bab909.dll
Size

180KB
MD5

e85985e115602813201713e09104e07f
SHA1

afdf99dc1c73c7a21916838aa279f1659b7028f1
SHA256

840a609768429c36b8a40d607c15455b1faa0f8f424ccb56dea8160d84bab909
SHA512

25ed366d188bfcc43902def653dfa40fae2233f31d872f1c43154a5ff2fb94e1586eeecab1b61dc184a8fbf6362d5dcf123555321e36d537076f3432e172b3e6
SSDEEP

3072:EuMX3+I7Dn9qpDL4DZ91oDT5xO2q4jEJyKx5b+qGJ6ayZLhzJWft:1+wpoDiLxYP5KqGcZLhE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
992	836	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 836	368	rundll32.exe	27
PID 368 wrote to memory of 836	368	rundll32.exe	27
PID 368 wrote to memory of 836	368	rundll32.exe	27
PID 368 wrote to memory of 836	368	rundll32.exe	27
PID 368 wrote to memory of 836	368	rundll32.exe	27
PID 368 wrote to memory of 836	368	rundll32.exe	27
PID 368 wrote to memory of 836	368	rundll32.exe	27
PID 836 wrote to memory of 992	836	rundll32.exe	28
PID 836 wrote to memory of 992	836	rundll32.exe	28
PID 836 wrote to memory of 992	836	rundll32.exe	28
PID 836 wrote to memory of 992	836	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\840a609768429c36b8a40d607c15455b1faa0f8f424ccb56dea8160d84bab909.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\840a609768429c36b8a40d607c15455b1faa0f8f424ccb56dea8160d84bab909.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 228
    3⤵
    - Program crash
    PID:992

memory/836-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/836-56-0x0000000000170000-0x0000000000186000-memory.dmp

Filesize
88KB

Download
memory/836-57-0x00000000001A0000-0x00000000001D0000-memory.dmp

Filesize
192KB

Download
memory/836-62-0x0000000000170000-0x0000000000186000-memory.dmp

Filesize
88KB

Download