6ffd9cb38cde78ef56ec635621c3f432ff095bede0cdf72b27ea41d4ad45cab4

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 01:24

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

2bb17d45e5ad92053ce1e500408dd8a9
SHA1

f5d3a7ee6e28df532e9ce33976c92ff30a5665e4
SHA256

71ce676703dad028e4083e6b960b1ed89885877079d46d5021506eaa6d99db53
SHA512

efdcb476b9b9b5691fe6b9cd77ecbe48d50c6683da01fd51c6b428cc262528fb3dcd295abe28718321b2307b0e032fcb599588f1eb00a93fd9e6a1f7b322b41f
SSDEEP

96:8eXR0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkNnLiEQjJ3KxkP:tvBfjbUA/85q3wEh8uLmsLpmP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 936	4608	rundll32.exe	81
PID 4608 wrote to memory of 936	4608	rundll32.exe	81
PID 4608 wrote to memory of 936	4608	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:936