50fa244bace65606484686c0468c38c07cacf8d51dd4be774e231dc94b63371c

Analysis

max time kernel
72s
max time network
76s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
10-07-2023 07:13

Target

Res/TVPSkin.dll
Size

124KB
MD5

66759c30143666d21dd98351df325c76
SHA1

9091be6630ad170d15ca6a6722ce53619ac61229
SHA256

e25b35196098206f4ea3903652eed409207a900863a4d7df5edb1c7ba1d94c93
SHA512

c27a54bc7565db3776c18900d044925ba7e121cc3ecdf8bac02cf40559e41c280b2b0ee0871803d7c85c5d98e4b0b9ecac3ec7d32ee99b59c61632be64e928d3
SSDEEP

1536:GPgVjdZ5PzDpe5zgCG1DT8vzsJkRU39PvpqfHvCuv/Aaz4Isxhr2Rejvz:GPg9vdDpemCG1ezZsPvpA6uQ4QTqRw

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2340 2332 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2340	2332	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2324 wrote to memory of 2332	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 2332	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 2332	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 2332	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 2332	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 2332	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 2332	2324	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 2340	2332	rundll32.exe	WerFault.exe
PID 2332 wrote to memory of 2340	2332	rundll32.exe	WerFault.exe
PID 2332 wrote to memory of 2340	2332	rundll32.exe	WerFault.exe
PID 2332 wrote to memory of 2340	2332	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Res\TVPSkin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Res\TVPSkin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 244
    3⤵
    - Program crash
    PID:2340