aa870e1218a74e244dbe047277a2037c22c4460cb5ebfc5d12267950121bad6f

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 10:33

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

1f56d9c34643cc8033ec8e628df11cfb
SHA1

1231b571a298c16a1f618799fc7d20b72ccb2747
SHA256

c1593d641b89c8cf294ce4efeaea5d0a69b095f04947ecdabbef73d3225d3480
SHA512

a0c80e6f5c4aa6f34b601951033b709944d3522a6faefad11d9d8f1b4398d379d4e5618029c8134204f344e8a71bfff4e19c2d6693f2119ffd05e67dd9148d24
SSDEEP

96:8eU0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkfnLiEQjJ3KxkP:tGBfjbUA/85q3wEh8uLm2LpmP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2760 wrote to memory of 2472	2760	rundll32.exe	rundll32.exe
PID 2760 wrote to memory of 2472	2760	rundll32.exe	rundll32.exe
PID 2760 wrote to memory of 2472	2760	rundll32.exe	rundll32.exe
PID 2760 wrote to memory of 2472	2760	rundll32.exe	rundll32.exe
PID 2760 wrote to memory of 2472	2760	rundll32.exe	rundll32.exe
PID 2760 wrote to memory of 2472	2760	rundll32.exe	rundll32.exe
PID 2760 wrote to memory of 2472	2760	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
2⤵
PID:2472