284a18ed393b0e60ca6fada933c6612df9862d024038c51a0ab8906ccbdcc990 | Triage

Analysis

max time kernel
132s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 07:47

Sharing

Report Analysis Logs

General

Target

Bmctr.dll
Size

27KB
MD5

422db4eb8ffa25ca41649266b6af183d
SHA1

876a743db67b40bf9e5acfb017fcd76be5321ce9
SHA256

0e55ca8fda6b896c8ae96807349ca4423659d1c18ce96f13ef2481ca0ce182a8
SHA512

b68df8fad84e6bf6b88bfdc2b40bb2396a26c98dc6d93dde300595180b0f86be151b43a78c50c738b62c5b4d7ca565a26556c7352a847a4c537c0a41c61df61b
SSDEEP

384:ifttcU0npH16UKGXkL7PaOQjW0OtaY8+SlQzwT/UOZnPVqOBXxQYtAeMRQ:ifc16UKGYPi6aYfSussOZndqweQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 1944	4080	rundll32.exe	85
PID 4080 wrote to memory of 1944	4080	rundll32.exe	85
PID 4080 wrote to memory of 1944	4080	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bmctr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bmctr.dll,#1
  2⤵
  PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads