2d52ef6c7d66fed4ca81a4a0e0adfad036d24653700fd17a45366826ce0ad45a

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 17:22

Target

$PLUGINSDIR/SkinProgress.dll
Size

4KB
MD5

cc037c4703d3ec257efeef2ce0a1a20e
SHA1

b3d6cc8f687a31fb2c1a5921a38de9429af20502
SHA256

888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff
SHA512

120bfa0a68775bef04c1863023b0e73a41982284fb36da7f497fbb7d5ed8631ad02fa09951424d339f6fefaa90a17c12f949dd68bb33bad64b1b7cace489d2a7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	2188	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2188	2184	rundll32.exe	29
PID 2184 wrote to memory of 2188	2184	rundll32.exe	29
PID 2184 wrote to memory of 2188	2184	rundll32.exe	29
PID 2184 wrote to memory of 2188	2184	rundll32.exe	29
PID 2184 wrote to memory of 2188	2184	rundll32.exe	29
PID 2184 wrote to memory of 2188	2184	rundll32.exe	29
PID 2184 wrote to memory of 2188	2184	rundll32.exe	29
PID 2188 wrote to memory of 2468	2188	rundll32.exe	30
PID 2188 wrote to memory of 2468	2188	rundll32.exe	30
PID 2188 wrote to memory of 2468	2188	rundll32.exe	30
PID 2188 wrote to memory of 2468	2188	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinProgress.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinProgress.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 224
    3⤵
    - Program crash
    PID:2468