aac1416d21318d7eec4ecc4e87d91cfbee0b5d569ff9642070c9947c4c59265e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 07:12

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

2bb17d45e5ad92053ce1e500408dd8a9
SHA1

f5d3a7ee6e28df532e9ce33976c92ff30a5665e4
SHA256

71ce676703dad028e4083e6b960b1ed89885877079d46d5021506eaa6d99db53
SHA512

efdcb476b9b9b5691fe6b9cd77ecbe48d50c6683da01fd51c6b428cc262528fb3dcd295abe28718321b2307b0e032fcb599588f1eb00a93fd9e6a1f7b322b41f
SSDEEP

96:8eXR0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkNnLiEQjJ3KxkP:tvBfjbUA/85q3wEh8uLmsLpmP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1536	4864	rundll32.exe	83
PID 4864 wrote to memory of 1536	4864	rundll32.exe	83
PID 4864 wrote to memory of 1536	4864	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:1536