238267c98ec07131f137309231d470c68d96edeb54682c3b6a308efdafe7ada2

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 19:39

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

2bb17d45e5ad92053ce1e500408dd8a9
SHA1

f5d3a7ee6e28df532e9ce33976c92ff30a5665e4
SHA256

71ce676703dad028e4083e6b960b1ed89885877079d46d5021506eaa6d99db53
SHA512

efdcb476b9b9b5691fe6b9cd77ecbe48d50c6683da01fd51c6b428cc262528fb3dcd295abe28718321b2307b0e032fcb599588f1eb00a93fd9e6a1f7b322b41f
SSDEEP

96:8eXR0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkNnLiEQjJ3KxkP:tvBfjbUA/85q3wEh8uLmsLpmP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 1088	3684	rundll32.exe	81
PID 3684 wrote to memory of 1088	3684	rundll32.exe	81
PID 3684 wrote to memory of 1088	3684	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:1088