2a3f928955893e6810408be597a7b15008d5b1999d1b70e3f7a73fcf8cddde58

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 19:39

Target

$PLUGINSDIR/K8Skin.dll
Size

420KB
MD5

fc2ff34420233f05ef99aab1bfad9b21
SHA1

06ce9d74e0f489b96afc83a5287846fa9e4c36d2
SHA256

6a2543f949265b3790fbb9e927c66e1797686c7ac9f6e981eb6c6944204870a1
SHA512

c4b05e40d729534a44830bf3dad6d851d4ef9330699773747c44b03929cda993d363c196044ff6a713a0b4abe35e9945cd9d8becfb89f43ab38a590666f28773
SSDEEP

6144:cG6ZseJhWlmKdRw8yBtzi9I6FCqdYDOXNOJMQUHN8nt3uoZR:c96e/WlmKdRr8li9IgCqYDOX8KzMUoP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28
PID 2924 wrote to memory of 2432	2924	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\K8Skin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\K8Skin.dll,#1
  2⤵
  PID:2432