531313033fdb71c44c0791f56679e55c36f06fa6250f90f68ebaf42e7a2a044b

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 06:29

Target

BDDocker.dll
Size

133KB
MD5

bac4430b877c7a7971f985a132cb7744
SHA1

8bdd4e5844d57638f9208e793dd33ff0825adff1
SHA256

c887bc567dd5c134389438ed65f9bc357458eef32195974d4c521ee051e21a3a
SHA512

012b60e1bd60b0ed846b05d8381a4f74b6b68fffbaab72c77a7d8ae29316148bbb59f5b6d3031ced1553c44530bcb09bb867fbe18f1a9965f75201e06fd56cdc
SSDEEP

1536:F+wpxI0iilTx2fv1JgGq22L3Ofe+Knum8FoqXmPZxRVHGBAHhY6hI32nK0E+MNn8:F+4xI/2TxK9vM3umwoFR6Gh0yK0Efnn8

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2080	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2080	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2080	2064	rundll32.exe	31
PID 2064 wrote to memory of 2080	2064	rundll32.exe	31
PID 2064 wrote to memory of 2080	2064	rundll32.exe	31
PID 2064 wrote to memory of 2080	2064	rundll32.exe	31
PID 2064 wrote to memory of 2080	2064	rundll32.exe	31
PID 2064 wrote to memory of 2080	2064	rundll32.exe	31
PID 2064 wrote to memory of 2080	2064	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BDDocker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BDDocker.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:2080