531313033fdb71c44c0791f56679e55c36f06fa6250f90f68ebaf42e7a2a044b | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 06:29

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/BDMSkin.dll
Size

1.8MB
MD5

3f6dc271f034861cb4be850a816105e3
SHA1

d83f7a11d47d4668737ff64139870bad8a8722a0
SHA256

4f5d4dc959ccb0f201b2f2c761c74f6284ec90fe4d05e11813c63f584356205a
SHA512

2149b342a8bb8486faf3e7ffe43b6fe66bad4b93512ed668caccdf63399a48411b92b31c99a018c92e4590584d8c0111a483f8161ec179d5f92aba2e398fa76a
SSDEEP

24576:l6HdOqkMfbZu853MkOiJnzC5LLpjA1Mr7zcy9apk/:lidxZuI3EL5A1y7zcy9apk/

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
744	3624	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3624	3448	rundll32.exe	85
PID 3448 wrote to memory of 3624	3448	rundll32.exe	85
PID 3448 wrote to memory of 3624	3448	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMSkin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMSkin.dll,#1
  2⤵
  PID:3624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 672
    3⤵
    - Program crash
    PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3624 -ip 3624
1⤵
PID:3184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads