112468aa12933ad14bac5eaf5195b51f06546af9b37adfa64cfcc59273174a8d | Triage

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 12:18

Sharing

Report Analysis Logs

General

Target

Modules/BdUdr.dll
Size

57KB
MD5

d190f11b66a2a12c29546f2fb824efdc
SHA1

b140988558c37df3b0503baa2a67900e22aec89d
SHA256

61ee08658a38baf56d5a46743e4fb5696b34f3b00e50ce4dacd31f5e4e2e7408
SHA512

32e232c91ab1e0663dc34772c5b50a0cbafffd11f4025617f79a603111248039ecd337d67efa1864fae8b09bbd480d4a7ee446e77e8f6754baa764d2dcfa2717
SSDEEP

1536:Iizk89A8AXKsjKrPjkj6fXIBMI283/pnQ+P7TS3iGj:3zk8W1okj6fXIeI283/pnBSN

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3068 wrote to memory of 1984	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 1984	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 1984	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 1984	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 1984	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 1984	3068	rundll32.exe	rundll32.exe
PID 3068 wrote to memory of 1984	3068	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\BdUdr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Modules\BdUdr.dll,#1
2⤵
PID:1984

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...