dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
145s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/BDMNetPlus.dll
Size 886KB
Sample240617-e7s6waydqq
SHA256 9d7ba68f888e6faa003e089406d83218cdd99b19de867a8b84ccc59f71ce266f
MD5 fff0616db65911080007bac98e198854
SHA1 a71d486122a6c5ed65f0115bef6c491d278db69e
SHA512 cc5116c9e6268d252a900d0483060e94f17fbec942ff4935db8b60e0dab3b798a8e81efc7b32a6721b8a00256e9f710aaa5c540a03107f1a5ce62428f02388ad
SSDEEP 24576:FHJL4YHB7zGUldTddAxPVbXY6ZzTd8KS38j:1GyazjZzTK2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 4000	4220	rundll32.exe	80
PID 4220 wrote to memory of 4000	4220	rundll32.exe	80
PID 4220 wrote to memory of 4000	4220	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMNetPlus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMNetPlus.dll,#1
  2⤵
  PID:4000