dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
150s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/BDMPluginMgr.dll
Size 758KB
Sample240617-e7s6waydqq
SHA256 81d2e08f0b4aeffb418764037e6ea2a3c10ddb3de4ce4f29d4162bf1a080bebc
MD5 9caedf3a0797beb008fe34eab1f8946c
SHA1 9372563e8eae57c099317d6f00b304fa6767b770
SHA512 a4fb7ca759817aaf45d9612dbbda01188009792a12f6c6a50d27bdbae4de70cc3571db07635efb6061a1062a4f48af52019a892a6db1ebd76a9e182e0fd70d3e
SSDEEP 12288:LqPV43d7CXBmE4cJlYjA3ph8iLjHKZR1tRaQsyPYSdeCw29J9XMifqPLJK30a8XA:uPV43d7CXBmE4cJlYjWph8iLjHKZR1tZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3308	2060	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 2060	3408	rundll32.exe	89
PID 3408 wrote to memory of 2060	3408	rundll32.exe	89
PID 3408 wrote to memory of 2060	3408	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMPluginMgr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMPluginMgr.dll,#1
  2⤵
  PID:2060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 640
    3⤵
    - Program crash
    PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 2060 -ip 2060
1⤵
PID:2000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3960 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:2352

memory/2060-0-0x0000000001270000-0x00000000012A7000-memory.dmp

Download