035c9942570c04ae3519e14fc8846933c5c99a59d2a3cf9a45a4166e119bc853

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 12:23

Target
$PLUGINSDIR/BgImage.dll
Size 7KB
Sample240417-pkfmdaef26
SHA256 d0607e535ff5573638ee1d70612e2239d5cb3c87307f48cfd57aa1c5cc0d9524
MD5 24db082241ace4aca15bdf1e8460c92b
SHA1 d317ef130af6ea6a72a958eee20a58568d38f23d
SHA512 ec1dcf17e2e72dbdf06d91250f0698cd50144836a1ee4a3e8a50605e27f8106db595c61a81349a72ce652bc03aee0033fed1700d87d8f2d0e4cd1db9515e7ee2
SSDEEP 96:8eD0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkznLiEQjJ3KxkP:tZBfjbUA/85q3wEh8uLmaLpmP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2920	1404	rundll32.exe	28
PID 1404 wrote to memory of 2920	1404	rundll32.exe	28
PID 1404 wrote to memory of 2920	1404	rundll32.exe	28
PID 1404 wrote to memory of 2920	1404	rundll32.exe	28
PID 1404 wrote to memory of 2920	1404	rundll32.exe	28
PID 1404 wrote to memory of 2920	1404	rundll32.exe	28
PID 1404 wrote to memory of 2920	1404	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:2920