dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/BDMFrameWork.dll
Size 226KB
Sample240617-e7s6waydqq
SHA256 5149a8d1a0d8f361fe4060092164eb44f363b8d7958ee7327529cc8f9eafdb25
MD5 d3e0ac527b9046dbb64a8d6b0927ede7
SHA1 6144bc024e1b880ef9920d0c644f80b3dcbd5991
SHA512 2079a76cf32e71d9c0bdda84a7ef9392e5a2e0f87ecd2a207e44f5393db59dacb937692b157ed54ef422e1ff088989a558886e95e34adc4813981fef894bf266
SSDEEP 3072:B7nZmQXS6Rd9gIwEDP8pjT+qOWK9TMVQEcOPqhAk5:B7nDzf+jCqOWKSVQEcwqhA0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	4040	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 4040	4196	rundll32.exe	82
PID 4196 wrote to memory of 4040	4196	rundll32.exe	82
PID 4196 wrote to memory of 4040	4196	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMFrameWork.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMFrameWork.dll,#1
  2⤵
  PID:4040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 620
    3⤵
    - Program crash
    PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4040 -ip 4040
1⤵
PID:3452