e2dca85ba15366a41846b1152329ad9c7abc8b410b5ee51d00b812c1d1eae761

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:39

Target

?????10?/bbxcomm.dll
Size

339KB
MD5

0c0731b749a20a9f687b54976e1f1277
SHA1

93a2253f1e87a78c7ef8d4b841d31450f4c7d49e
SHA256

6d7ba5076c454b527b0dad54b43b4e08af27baf902d47421a6a8d0ce92c6c058
SHA512

cff7c7dd67da851f8637de66b0864b019e417c5dd5423ac9a20455d92ccf2e717a5dc5ac2820848a6a5706ef0609100dd3081557b84ec2e9580f8d25e48a1105
SSDEEP

3072:2k/XVm652zDx0l1pKxXdaY4vzouz+ocGKu0H6JymjIpZhNSM44G4444444444D4S:2k/XVpi0lDKkou8GK16JymjIp8pTpQLw

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4732 4420 WerFault.exe rundll32.exe
532 4420 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4732	4420	WerFault.exe	rundll32.exe
532	4420	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1128 wrote to memory of 4420	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 4420	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 4420	1128	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_____10_\bbxcomm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_____10_\bbxcomm.dll,#1
2⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 676
3⤵
- Program crash
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 708
3⤵
- Program crash
PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4420 -ip 4420
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4420 -ip 4420
1⤵
PID:448