dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/BDMReport.dll
Size 430KB
Sample240617-e7s6waydqq
SHA256 29f1690afc465616d89dc59656a080f56bc563acc6d7ccb6dead8c34d4b8f38f
MD5 b95b19c74b07460a74e48c1384c7e76d
SHA1 0690be1b93a14ac492246351e0f320c9b47c670e
SHA512 f8f94581666ed907649aeecd1ca0b935c3cc7fbf3ed2853b24cc87dd4eee7835d9884e4b38f8a43a4b3946cd47c832d46816ec0c8788b12768c420911fa77005
SSDEEP 6144:ea5TcCazL+fUiqH5kPFuDHmvhFgXmM5sfhiMei9sTB7BB694/ODtMh:B14+fUihFjvgN5sfhUi9sTlB+4Zh
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3688	4044	rundll32.exe	83
PID 4044 wrote to memory of 3688	4044	rundll32.exe	83
PID 4044 wrote to memory of 3688	4044	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMReport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMReport.dll,#1
  2⤵
  PID:3688