d428e48a77074d621d8a375f6130e3d85b82097d6d0cc90b030557388bb9b313

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 07:39

Target

$PLUGINSDIR/SkinBtn.dll
Size

4KB
MD5

e4ec95271ff1bcebab49bdfed6817a22
SHA1

2c03e97f4773aea80ecdb98a1482e5896fe4677b
SHA256

ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
SHA512

771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
SSDEEP

48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	3428	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 3428	3884	rundll32.exe	84
PID 3884 wrote to memory of 3428	3884	rundll32.exe	84
PID 3884 wrote to memory of 3428	3884	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinBtn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinBtn.dll,#1
  2⤵
  PID:3428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 620
    3⤵
    - Program crash
    PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3428 -ip 3428
1⤵
PID:1940