dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
50s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/BDLogicUtils.dll
Size 282KB
Sample240617-e7s6waydqq
SHA256 25f671709f69b45a81f32d959e74ac71340ae558439ee96ba99094467a4d56e5
MD5 c374cbabc15f274de9008881a84e7d25
SHA1 7bc01142a2b7c1acf45a6728ec6f87b60a973f88
SHA512 c70161222fed075f7e97c59c0f304486dfb2bfc9376040cb6609b53fdb0f1e2bbe595ab415624073902b0f40851800550ef57e494ba0687e1affd96b01ea09d7
SSDEEP 3072:xjs9d36BeoRnBpu9VcEeoApyZfOVLURFXT1z6g/oIyxTBfwPlFT+7J2dftrJO16d:RUMBe4g0cIgwIoTBIPvT+w7rJO1YGm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1748	2208	rundll32.exe	82
PID 2208 wrote to memory of 1748	2208	rundll32.exe	82
PID 2208 wrote to memory of 1748	2208	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDLogicUtils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDLogicUtils.dll,#1
  2⤵
  PID:1748

memory/1748-1-0x0000000002B00000-0x0000000002B37000-memory.dmp

Download

memory/1748-3-0x0000000002B40000-0x0000000002BFE000-memory.dmp

Download