9a1fbf837e9e350ac567457bdaa0ada6cd3aeb441433a298f4d2aea51b359842

Analysis

max time kernel
140s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 11:32

Target

$PLUGINSDIR/SkinBtn.dll
Size

4KB
MD5

e4ec95271ff1bcebab49bdfed6817a22
SHA1

2c03e97f4773aea80ecdb98a1482e5896fe4677b
SHA256

ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
SHA512

771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
SSDEEP

48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1804	2800	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 2800	5088	rundll32.exe	86
PID 5088 wrote to memory of 2800	5088	rundll32.exe	86
PID 5088 wrote to memory of 2800	5088	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinBtn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinBtn.dll,#1
  2⤵
  PID:2800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 620
    3⤵
    - Program crash
    PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2800 -ip 2800
1⤵
PID:3184