50fa244bace65606484686c0468c38c07cacf8d51dd4be774e231dc94b63371c

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2023 13:08

Target

Res/TVPSkin.dll
Size

124KB
MD5

66759c30143666d21dd98351df325c76
SHA1

9091be6630ad170d15ca6a6722ce53619ac61229
SHA256

e25b35196098206f4ea3903652eed409207a900863a4d7df5edb1c7ba1d94c93
SHA512

c27a54bc7565db3776c18900d044925ba7e121cc3ecdf8bac02cf40559e41c280b2b0ee0871803d7c85c5d98e4b0b9ecac3ec7d32ee99b59c61632be64e928d3
SSDEEP

1536:GPgVjdZ5PzDpe5zgCG1DT8vzsJkRU39PvpqfHvCuv/Aaz4Isxhr2Rejvz:GPg9vdDpemCG1ezZsPvpA6uQ4QTqRw

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4228 3392 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4228	3392	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4372 wrote to memory of 3392	4372	rundll32.exe	rundll32.exe
PID 4372 wrote to memory of 3392	4372	rundll32.exe	rundll32.exe
PID 4372 wrote to memory of 3392	4372	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Res\TVPSkin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Res\TVPSkin.dll,#1
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 636
    3⤵
    - Program crash
    PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3392 -ip 3392
1⤵
PID:2164