dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/file/BDConfig.dll
Size 486KB
Sample240617-e7s6waydqq
SHA256 6da5b3222321574eb4b0c5041075a7dd750469f5f239c6bcf250a8a7f17f3b7c
MD5 93e4a86cdda161264533584821e3ee4f
SHA1 f29182b2d0ce575cf4b1b32a9313908b8e43358b
SHA512 6b43850c8c5040f1c8daf2f7d213c0733c9b77204f90bb03be195a2502c5b03cf0bf5935ee7f5e6cc8b23aa3a9c6a77f0c7521a0a26beda162354fbfcb4be7ce
SSDEEP 6144:KnaAuy95y8sPL6qraySVKAKUNel/hEv2DS/XdMHDmvp1NOLjw9xDhE:Kna3/tOyjM2WVMHivpWwHdE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 3024	2700	rundll32.exe	28
PID 2700 wrote to memory of 3024	2700	rundll32.exe	28
PID 2700 wrote to memory of 3024	2700	rundll32.exe	28
PID 2700 wrote to memory of 3024	2700	rundll32.exe	28
PID 2700 wrote to memory of 3024	2700	rundll32.exe	28
PID 2700 wrote to memory of 3024	2700	rundll32.exe	28
PID 2700 wrote to memory of 3024	2700	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\file\BDConfig.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\file\BDConfig.dll,#1
  2⤵
  PID:3024