05d1700ab898b778fa6cf5bd8eca10d4f037dbbb9d3ac375e7fd91da520ca156 | Triage

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 22:43

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/BDMSkin.dll
Size

1.3MB
MD5

b540a866191f7fd20f5e6355bc2b094e
SHA1

df01a0c011e88a1f860db41d474d3fe893f06082
SHA256

ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6
SHA512

e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331
SSDEEP

24576:JLe//qOJqzo/K3vgexi4elHo7ttsmMTWyfx:Blzo0RXhvMTZ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3188	4220	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4220	4412	rundll32.exe	81
PID 4412 wrote to memory of 4220	4412	rundll32.exe	81
PID 4412 wrote to memory of 4220	4412	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMSkin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMSkin.dll,#1
  2⤵
  PID:4220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 688
    3⤵
    - Program crash
    PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4220 -ip 4220
1⤵
PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads