35b25b97905a85d591e551404df386b4fb50ccf60aa5da9ce41283e66d300220 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 10:53

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

0e6d71e08eb5f3fe111c2fc10cf3f669
SHA1

e50d07fa89a8a36e39196ef91ee10e6ce7e96289
SHA256

df4ae53731440c2a7fbabac6ded7684fadc03c050c3190a6ec38b1eaf88b76b9
SHA512

20325b41ea54f8aeae09a127e15400d462e99a86365d8b82d4b2d2cc13db6d7ecbb9e5db23091d8b68a92b3bb8cf87fabf9decd3f77089e32af2cdbfd705b77c
SSDEEP

96:alM5gksp42lLPFqtwlkqliJLDfr/W8uo6qkAn1dZ7:aljksp42lLPAJD/W8uoX3nZ7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28
PID 2132 wrote to memory of 2056	2132	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:2056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads