aac1416d21318d7eec4ecc4e87d91cfbee0b5d569ff9642070c9947c4c59265e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 01:39

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

2bb17d45e5ad92053ce1e500408dd8a9
SHA1

f5d3a7ee6e28df532e9ce33976c92ff30a5665e4
SHA256

71ce676703dad028e4083e6b960b1ed89885877079d46d5021506eaa6d99db53
SHA512

efdcb476b9b9b5691fe6b9cd77ecbe48d50c6683da01fd51c6b428cc262528fb3dcd295abe28718321b2307b0e032fcb599588f1eb00a93fd9e6a1f7b322b41f
SSDEEP

96:8eXR0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkNnLiEQjJ3KxkP:tvBfjbUA/85q3wEh8uLmsLpmP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2840	2964	rundll32.exe	28
PID 2964 wrote to memory of 2840	2964	rundll32.exe	28
PID 2964 wrote to memory of 2840	2964	rundll32.exe	28
PID 2964 wrote to memory of 2840	2964	rundll32.exe	28
PID 2964 wrote to memory of 2840	2964	rundll32.exe	28
PID 2964 wrote to memory of 2840	2964	rundll32.exe	28
PID 2964 wrote to memory of 2840	2964	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:2840