2293eda2e44910f45aaaea64bbfdf5225d468e4f9645cb193609b5c399b7ac2e

Analysis

max time kernel
132s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 21:54

Target

$PLUGINSDIR/bznrg.dll
Size

120KB
MD5

488e33035c112916a956f345dd5d8551
SHA1

0f95cdf5d5dc3bbad72bd881abf296afb306ff74
SHA256

2c81bb55b707f61827083b29d685235056480f563a3ff6e6d34046c50ed82a27
SHA512

146b404e0ad60249d3d75cf81793d41e12880c57574d13b47ec7ddc0bad7136a581c7d3828d2d3a5f3073addcc57fe03de8897432e769f4ada9c9490945ab0e7
SSDEEP

1536:FhdeTMPViwLdiIuoV/E35+E1mmbfkRNn9RSLMPJFGrnaB3ZoJKMSfU:FaTO4IuwyhbydjJFGc3Z+JSc

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 444	1336	rundll32.exe	85
PID 1336 wrote to memory of 444	1336	rundll32.exe	85
PID 1336 wrote to memory of 444	1336	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bznrg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bznrg.dll,#1
  2⤵
  PID:444