c9a985aea86448e6770b76c334fbd6a83658df00688bd4e754bde0ec0a12504f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 15:02

Target
$PLUGINSDIR/BgImage.dll
Size 7KB
Sample240608-seflzadf32
SHA256 a45f294137e2b0f6092eee8fdd2e19334f34ff3640d865a810b70f2104e92c21
MD5 ee255bdf426349e1caa8f1b71de9fd22
SHA1 d589773826620046df1d77dd148f819a88dd35ec
SHA512 71eeb41b5816b7d0f9517264aaf026da878561b6a222064c8100e47c383de9ac369800b734468322f3a6fc3eedb1a23d3c5ca6874bd7bf84af08f395248872cc
SSDEEP 96:8ePik1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uTc4j7J3kWyy/:tPdTJa2roqJyA2EN8diuTJje
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28
PID 2912 wrote to memory of 2552	2912	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:2552