c9736cdc4ade9fddb9b293e0366f182f972154d98169b58e532b7905c310bf97

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 06:41

Target
$PLUGINSDIR/BgImage.dll
Size 7KB
Sample240715-hfsb2ssgrl
SHA256 d0607e535ff5573638ee1d70612e2239d5cb3c87307f48cfd57aa1c5cc0d9524
MD5 24db082241ace4aca15bdf1e8460c92b
SHA1 d317ef130af6ea6a72a958eee20a58568d38f23d
SHA512 ec1dcf17e2e72dbdf06d91250f0698cd50144836a1ee4a3e8a50605e27f8106db595c61a81349a72ce652bc03aee0033fed1700d87d8f2d0e4cd1db9515e7ee2
SSDEEP 96:8eD0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkznLiEQjJ3KxkP:tZBfjbUA/85q3wEh8uLmaLpmP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 1036	1604	rundll32.exe	30
PID 1604 wrote to memory of 1036	1604	rundll32.exe	30
PID 1604 wrote to memory of 1036	1604	rundll32.exe	30
PID 1604 wrote to memory of 1036	1604	rundll32.exe	30
PID 1604 wrote to memory of 1036	1604	rundll32.exe	30
PID 1604 wrote to memory of 1036	1604	rundll32.exe	30
PID 1604 wrote to memory of 1036	1604	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BgImage.dll,#1
  2⤵
  PID:1036