57e90295056333b0de05689523eef17285d034a25a9a1965d789da54af854aee

Analysis

max time kernel
51s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:17

Target
SkinCrafter3_vs2005.dll
Size 564KB
Sample240614-algtha1cpm
SHA256 5aaa62566d7daba371fbf221f0d93402b6560ef6032e23aeab55cacb1462c8eb
MD5 b5acb37197211dc215907499bc105745
SHA1 9f49f51cd716de78439617a10dd640b7f8f3a669
SHA512 bed50c385a3c1535a855720c616eb8540cf49a8f36793a43874416b0882f27ed4dbf11340ddb48308f9a0933d53add24e0392af53e692af6337ba951d9fa93f1
SSDEEP 12288:aNWqllnRg3Fo8e+xYFvqgMiMtF+YJ6ihCT34g:aNEFk50xvMT34g
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 2180	4064	regsvr32.exe	82
PID 4064 wrote to memory of 2180	4064	regsvr32.exe	82
PID 4064 wrote to memory of 2180	4064	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SkinCrafter3_vs2005.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SkinCrafter3_vs2005.dll
  2⤵
  PID:2180