dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/BDMPluginMgr.dll
Size 758KB
Sample240617-e7s6waydqq
SHA256 81d2e08f0b4aeffb418764037e6ea2a3c10ddb3de4ce4f29d4162bf1a080bebc
MD5 9caedf3a0797beb008fe34eab1f8946c
SHA1 9372563e8eae57c099317d6f00b304fa6767b770
SHA512 a4fb7ca759817aaf45d9612dbbda01188009792a12f6c6a50d27bdbae4de70cc3571db07635efb6061a1062a4f48af52019a892a6db1ebd76a9e182e0fd70d3e
SSDEEP 12288:LqPV43d7CXBmE4cJlYjA3ph8iLjHKZR1tRaQsyPYSdeCw29J9XMifqPLJK30a8XA:uPV43d7CXBmE4cJlYjWph8iLjHKZR1tZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	2320	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 1368 wrote to memory of 2320	1368	rundll32.exe	28
PID 2320 wrote to memory of 3036	2320	rundll32.exe	29
PID 2320 wrote to memory of 3036	2320	rundll32.exe	29
PID 2320 wrote to memory of 3036	2320	rundll32.exe	29
PID 2320 wrote to memory of 3036	2320	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMPluginMgr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMPluginMgr.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 236
    3⤵
    - Program crash
    PID:3036

memory/2320-0-0x00000000001D0000-0x0000000000207000-memory.dmp

Download