284a18ed393b0e60ca6fada933c6612df9862d024038c51a0ab8906ccbdcc990 | Triage

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 07:47

Sharing

Report Analysis Logs

General

Target

Bmcmon.dll
Size

100KB
MD5

bb4685108a58021a8886d83f81820ed5
SHA1

daa8a73b3f535bbe51a052000c430022f2b19cbb
SHA256

a2da91ab675eb813757957596e3dddd43ea7716df47fcf61bdca167611402076
SHA512

cf382ad18b94c7eb750e19532996fcfe929d7a28f88279679fc0fe69dd85f702a1c892d22184263d0cc0c51f980e9b5e6737f18caf246dd7f61329428c603d22
SSDEEP

3072:WIsYjPy9GGX2tEA540d5YR3he+/nXoCrvLOZyfb:33W99X0540d5yhdLOZyj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1600	2208	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2208	2176	rundll32.exe	28
PID 2176 wrote to memory of 2208	2176	rundll32.exe	28
PID 2176 wrote to memory of 2208	2176	rundll32.exe	28
PID 2176 wrote to memory of 2208	2176	rundll32.exe	28
PID 2176 wrote to memory of 2208	2176	rundll32.exe	28
PID 2176 wrote to memory of 2208	2176	rundll32.exe	28
PID 2176 wrote to memory of 2208	2176	rundll32.exe	28
PID 2208 wrote to memory of 1600	2208	rundll32.exe	29
PID 2208 wrote to memory of 1600	2208	rundll32.exe	29
PID 2208 wrote to memory of 1600	2208	rundll32.exe	29
PID 2208 wrote to memory of 1600	2208	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bmcmon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bmcmon.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 220
    3⤵
    - Program crash
    PID:1600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads