5318739a0a7ac64d992edf27091adad9610a821c92f4a92793543b214d96a308

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 13:23

Target

$PLUGINSDIR/SkinBtn.dll
Size

4KB
MD5

e4ec95271ff1bcebab49bdfed6817a22
SHA1

2c03e97f4773aea80ecdb98a1482e5896fe4677b
SHA256

ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
SHA512

771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
SSDEEP

48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3924	2948	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2948	1068	rundll32.exe	83
PID 1068 wrote to memory of 2948	1068	rundll32.exe	83
PID 1068 wrote to memory of 2948	1068	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinBtn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinBtn.dll,#1
  2⤵
  PID:2948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 620
    3⤵
    - Program crash
    PID:3924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2948 -ip 2948
1⤵
PID:1560