284a18ed393b0e60ca6fada933c6612df9862d024038c51a0ab8906ccbdcc990

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 07:47

Target

Bmbt.dll
Size

1.5MB
MD5

a67ad710d0bce067e179e1d9c8beb518
SHA1

3a747477318c9fe6f4631144d8c2aec99a06d35e
SHA256

4cc6003ec2e7441f108ac43d36ef89ebb13f9f41a8f23ead4d489b7fbbbefcb8
SHA512

3d94f028ce80c00782ed0f55ddbc1eb538b86444a0d090790ac6e5822af14e2a1bf106a10a686e5f599ff2973b6f03e6d8fccc03e7967fed83f5ce511e4f53db
SSDEEP

24576:QaQluAtYLo1vwPPmo0XWpaKOoADNPQBA9d87tlCRnjLy4qBDT1mdI+xEe:dQQAkodwPeo13uySKoRjL8DT1mUe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	2552	WerFault.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2552	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 1952 wrote to memory of 2552	1952	rundll32.exe	28
PID 2552 wrote to memory of 2936	2552	rundll32.exe	29
PID 2552 wrote to memory of 2936	2552	rundll32.exe	29
PID 2552 wrote to memory of 2936	2552	rundll32.exe	29
PID 2552 wrote to memory of 2936	2552	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bmbt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bmbt.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 308
    3⤵
    - Program crash
    PID:2936