b1a522cf1688c79e5148c41caa7ebf9c71f9cb0a87e3d2c3acd4a0e5f9c22705

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 16:04

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

1f56d9c34643cc8033ec8e628df11cfb
SHA1

1231b571a298c16a1f618799fc7d20b72ccb2747
SHA256

c1593d641b89c8cf294ce4efeaea5d0a69b095f04947ecdabbef73d3225d3480
SHA512

a0c80e6f5c4aa6f34b601951033b709944d3522a6faefad11d9d8f1b4398d379d4e5618029c8134204f344e8a71bfff4e19c2d6693f2119ffd05e67dd9148d24
SSDEEP

96:8eU0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkfnLiEQjJ3KxkP:tGBfjbUA/85q3wEh8uLm2LpmP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:2348