43358b1bf2342e4c45179ffe1eba80b41fe64ca7aba3cf0e551f5ceada787b59

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/03/2024, 04:01

Target
SkinMagic.dll
Size 338KB
Sample240321-elpassbd94
SHA256 ceb7619f16a1a45e1ae13feceee5c7229ee105466dc949e5decad67640e2743d
MD5 717c74d999f9181cba5ded8586837a59
SHA1 4cc576ceb443cfa47a4f51cbc1bb4ff8ccc58909
SHA512 253fd81e29e377ce92b3e58a3d1ac6f1789a571945e33d655ae4f8136f9328abe6e6607fdc379250c94c5113a7a312349fdc604cfb05ac1a560a2b589a6b49a6
SSDEEP 6144:mK5lbvKUX/qfBeFuGnJY2SSJPdfe1CDihWhBvlhrUyRZWLqd8xMA:jTKUXiZ222S+P01CDDnrUyRo2d8x5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3028	3032	rundll32.exe	28
PID 3032 wrote to memory of 3028	3032	rundll32.exe	28
PID 3032 wrote to memory of 3028	3032	rundll32.exe	28
PID 3032 wrote to memory of 3028	3032	rundll32.exe	28
PID 3032 wrote to memory of 3028	3032	rundll32.exe	28
PID 3032 wrote to memory of 3028	3032	rundll32.exe	28
PID 3032 wrote to memory of 3028	3032	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SkinMagic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SkinMagic.dll,#1
  2⤵
  PID:3028