c8ef778ff1e9493aecd06b7be81c033356d288235494e6ae5d67bd0cc6789195

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 01:48 UTC

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

a98576f0d6b35b466cb881860977fdbc
SHA1

28b3dbbd76f15c876b98dce523100aa3256d193a
SHA256

6cc4aadae46ee3e7f39b411ba087ec29bc10aa62b6b5b44003c934b3c51cefe2
SHA512

29225bfb30e72d7d3d3571e7562b5901dbf2382af1972cc9a2be8e3bef697b9ac9e0aaac3a9bca191da827ad3cfce7f6876e8be9444663e83a7e2e86788a733c
SSDEEP

96:8e70AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk7nLiEQjJ3KxkP:tBBfjbUA/85q3wEh8uLmqLpmP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:1048