cdae5c24bd6813de0e0c71748062db520bb43ab16a1995e9de684e2ededa9cae

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-05-2024 09:36

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

1f56d9c34643cc8033ec8e628df11cfb
SHA1

1231b571a298c16a1f618799fc7d20b72ccb2747
SHA256

c1593d641b89c8cf294ce4efeaea5d0a69b095f04947ecdabbef73d3225d3480
SHA512

a0c80e6f5c4aa6f34b601951033b709944d3522a6faefad11d9d8f1b4398d379d4e5618029c8134204f344e8a71bfff4e19c2d6693f2119ffd05e67dd9148d24
SSDEEP

96:8eU0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkfnLiEQjJ3KxkP:tGBfjbUA/85q3wEh8uLm2LpmP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1732 wrote to memory of 2544	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2544	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2544	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2544	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2544	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2544	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2544	1732	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
2⤵
PID:2544