25bff48681722f169b4535d7564606d13de109f529177c2f1c8f1ed2ea46412f

Analysis

max time kernel
139s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 01:23

Target
$PLUGINSDIR/BgImage.dll
Size 7KB
Sample240607-brscvsfb4y
SHA256 27d3e3e359e1e04b173277221055d043e2f3baaf78a5d6f7e3a0a5dfcb96222c
MD5 5da88848798426643f9810237b58937d
SHA1 e1830dca870437116b93decba8d0ba81f1056d65
SHA512 859d0fef023b6fb9c41589e4aa5bcfc23259639aaad2fb51e1304725d6e28852bd6b6a68ffca8c6a20adae4d735e6a03620890036ed57095f40318804153f586
SSDEEP 96:8e3k1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uTF4j7J3kWyy/:t0TJa2roqJyA2EN8diuTSje
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 5004	412	rundll32.exe	90
PID 412 wrote to memory of 5004	412	rundll32.exe	90
PID 412 wrote to memory of 5004	412	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:3556