0b4a3dd50fed1972cb41fa18b79d8a51ae8b15ae8d31e4facd926a86bfa6926f

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:26

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

143c1b18ccd1ab2ceed02caf0e06ef8a
SHA1

b59d780e0a85f816b41aa657d4a643d77bd20a99
SHA256

8920afae5d9c06f6ba1f254a1e32ac2acfb0fdb11ab2158cfe880a191045e3d7
SHA512

91bd09610679224a7774044b16054721567385d3faa241e72b51f27ef660870f7282e887016df492d5b3ab3b6d9c130e036258c4f27d5ca4cc3a12b76ff71b39
SSDEEP

96:8eS0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk5nLiEQjJ3KxkP:t8BfjbUA/85q3wEh8uLmcLpmP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4764 wrote to memory of 1548	4764	rundll32.exe	rundll32.exe
PID 4764 wrote to memory of 1548	4764	rundll32.exe	rundll32.exe
PID 4764 wrote to memory of 1548	4764	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:1548