9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 09:05

Target

$PLUGINSDIR/BgImage.dll
Size

7KB
MD5

521df745a41f0b8164ffd01717cacbba
SHA1

dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74
SHA256

dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b
SHA512

c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe
SSDEEP

96:8eZ0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqk4jnLiEQjJ3KxkP:tXBfjbUA/85q3wEh8uLmVLpmP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2576	2548	rundll32.exe	30
PID 2548 wrote to memory of 2576	2548	rundll32.exe	30
PID 2548 wrote to memory of 2576	2548	rundll32.exe	30
PID 2548 wrote to memory of 2576	2548	rundll32.exe	30
PID 2548 wrote to memory of 2576	2548	rundll32.exe	30
PID 2548 wrote to memory of 2576	2548	rundll32.exe	30
PID 2548 wrote to memory of 2576	2548	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:2576