2b1e95e09f17b8495ebbbbaccf86418440cfaeb4fadd8156ab7fc533c1efb152

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 11:24

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

a98576f0d6b35b466cb881860977fdbc
SHA1

28b3dbbd76f15c876b98dce523100aa3256d193a
SHA256

6cc4aadae46ee3e7f39b411ba087ec29bc10aa62b6b5b44003c934b3c51cefe2
SHA512

29225bfb30e72d7d3d3571e7562b5901dbf2382af1972cc9a2be8e3bef697b9ac9e0aaac3a9bca191da827ad3cfce7f6876e8be9444663e83a7e2e86788a733c
SSDEEP

96:8e70AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk7nLiEQjJ3KxkP:tBBfjbUA/85q3wEh8uLmqLpmP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1716	5076	rundll32.exe	83
PID 5076 wrote to memory of 1716	5076	rundll32.exe	83
PID 5076 wrote to memory of 1716	5076	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:1716