3fc5e4d002e04269f2f674e6a2e98935df133ffe0f1fd54c817662d864c2f1b8

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 01:18

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

a98576f0d6b35b466cb881860977fdbc
SHA1

28b3dbbd76f15c876b98dce523100aa3256d193a
SHA256

6cc4aadae46ee3e7f39b411ba087ec29bc10aa62b6b5b44003c934b3c51cefe2
SHA512

29225bfb30e72d7d3d3571e7562b5901dbf2382af1972cc9a2be8e3bef697b9ac9e0aaac3a9bca191da827ad3cfce7f6876e8be9444663e83a7e2e86788a733c
SSDEEP

96:8e70AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk7nLiEQjJ3KxkP:tBBfjbUA/85q3wEh8uLmqLpmP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28
PID 2284 wrote to memory of 2272	2284	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:2272