852a0d477d29d18d5b7c419e4d64a90761e04c908fc7171e2faab5ad40021fbc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 14:29

Target
$PLUGINSDIR/BgImage.dll
Size 7KB
Sample240522-rtlwvsed7t
SHA256 286f246ee18bf91c4a80fa2cdb61077a4bcf0a3fd6582be4b4ab6a5cb3de44c9
MD5 9436196007f65f0ae96f64b1c8b2572e
SHA1 4b004b5c2865c9450876be83faa8cc96e1d12c01
SHA512 5c172675fbbea214471ac35eebaa6ab9bd1306268144085adbad3bba4a815430ed028cac169e8b5a6fd00818684f65d7bdd32f11773bc6152e62ef80f895d35e
SSDEEP 96:8egk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uT24j7J3kWyy/:t7TJa2roqJyA2EN8diuTHje
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28
PID 764 wrote to memory of 3064	764	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:3064