ee53e894a28570f3e592c313f9beaf3043c18097c966e86a579e3f25efc559bf

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 01:18

Target

$PLUGINSDIR/kgskin.dll
Size

456KB
MD5

df5258b74cc1238a5cb59e860e756904
SHA1

210089135570cd64eb01d13cedcb95f030f8f26f
SHA256

04569051e07d0418463c2ea2958f80472c30549beb139a421583ad663df4a992
SHA512

739a39dde21251f01081a7f3709d3e1b9136ddf96a27da6caeff70c76b48bcf8e419af7f7054c1d913843fd0e9dd735278295b113f8160b7129d845724f7a7ae
SSDEEP

3072:nZW8cTwmhUuclXSI6Em7Rx+o45jp9OKrQz+3YVpcUmSdpsisdopkLb0n8DYDW0qy:ps0XSpx+o45jpLZ85sCpAkDpf0xS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	224	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 224	340	rundll32.exe	83
PID 340 wrote to memory of 224	340	rundll32.exe	83
PID 340 wrote to memory of 224	340	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kgskin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kgskin.dll,#1
  2⤵
  PID:224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 644
    3⤵
    - Program crash
    PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 224 -ip 224
1⤵
PID:1868