b17b8be05fc8389990be623a727369826383bfc2fb33693943f208faa184ff40

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
30/03/2024, 03:30

Target
$PLUGINSDIR/jmmnbh.dll
Size 33KB
Sample240330-d2vbbaga8v
SHA256 f0ed5b1f290b36168d3cdce44b29a92dde64b558b350576431983f902fedeb8e
MD5 3fe6933172cb97cd2f22413f795660ba
SHA1 1ee9dfeb2329eb108ec654db3e87f1e698e0e731
SHA512 e946a1b33031678108f325d4464b6fd6ff889cd397c2eb2e51347f0a9e33d3837ca2b020cfb9d34bd24ae7a4864b0549f2ab97fc560f39f00c0b82b17f054052
SSDEEP 384:Io2inGgH1YPO7bfcWHRiMc9Zwg/XpvK5X/XJm5d/rgjQrX+dtWJdYLeWU9TkNNWt:H26j710wxO/rgjQrYtWLoSYlPz+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2956	2900	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2900	2884	rundll32.exe	28
PID 2884 wrote to memory of 2900	2884	rundll32.exe	28
PID 2884 wrote to memory of 2900	2884	rundll32.exe	28
PID 2884 wrote to memory of 2900	2884	rundll32.exe	28
PID 2884 wrote to memory of 2900	2884	rundll32.exe	28
PID 2884 wrote to memory of 2900	2884	rundll32.exe	28
PID 2884 wrote to memory of 2900	2884	rundll32.exe	28
PID 2900 wrote to memory of 2956	2900	rundll32.exe	29
PID 2900 wrote to memory of 2956	2900	rundll32.exe	29
PID 2900 wrote to memory of 2956	2900	rundll32.exe	29
PID 2900 wrote to memory of 2956	2900	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\jmmnbh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\jmmnbh.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 264
    3⤵
    - Program crash
    PID:2956