284a18ed393b0e60ca6fada933c6612df9862d024038c51a0ab8906ccbdcc990 | Triage

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 07:47

Sharing

Report Analysis Logs

General

Target

Bmcmon.dll
Size

100KB
MD5

bb4685108a58021a8886d83f81820ed5
SHA1

daa8a73b3f535bbe51a052000c430022f2b19cbb
SHA256

a2da91ab675eb813757957596e3dddd43ea7716df47fcf61bdca167611402076
SHA512

cf382ad18b94c7eb750e19532996fcfe929d7a28f88279679fc0fe69dd85f702a1c892d22184263d0cc0c51f980e9b5e6737f18caf246dd7f61329428c603d22
SSDEEP

3072:WIsYjPy9GGX2tEA540d5YR3he+/nXoCrvLOZyfb:33W99X0540d5yhdLOZyj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	5088	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 5088	4728	rundll32.exe	86
PID 4728 wrote to memory of 5088	4728	rundll32.exe	86
PID 4728 wrote to memory of 5088	4728	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bmcmon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bmcmon.dll,#1
  2⤵
  PID:5088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 608
    3⤵
    - Program crash
    PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5088 -ip 5088
1⤵
PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads