4b27de8a7f73d469420c292dc63c895c075dfb3d6d641781eadeac3646e5f704

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 18:15

Target

$PLUGINSDIR/SkinBtn.dll
Size

4KB
MD5

e4ec95271ff1bcebab49bdfed6817a22
SHA1

2c03e97f4773aea80ecdb98a1482e5896fe4677b
SHA256

ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
SHA512

771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
SSDEEP

48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2408 2120 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2408	2120	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3064 wrote to memory of 2120	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 2120	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 2120	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 2120	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 2120	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 2120	3064	rundll32.exe	rundll32.exe
PID 3064 wrote to memory of 2120	3064	rundll32.exe	rundll32.exe
PID 2120 wrote to memory of 2408	2120	rundll32.exe	WerFault.exe
PID 2120 wrote to memory of 2408	2120	rundll32.exe	WerFault.exe
PID 2120 wrote to memory of 2408	2120	rundll32.exe	WerFault.exe
PID 2120 wrote to memory of 2408	2120	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinBtn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinBtn.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 228
3⤵
- Program crash
PID:2408