6d27a4abf0b2438f8d5cf4f6ada7798be1b8208d36674705252c631dd6f844e9

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 12:12

Target
$PLUGINSDIR/SkinBtn.dll
Size 4KB
Sample240616-pdbpvasfph
SHA256 ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
MD5 e4ec95271ff1bcebab49bdfed6817a22
SHA1 2c03e97f4773aea80ecdb98a1482e5896fe4677b
SHA512 771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
SSDEEP 48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
32	1924	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 1924	3856	rundll32.exe	84
PID 3856 wrote to memory of 1924	3856	rundll32.exe	84
PID 3856 wrote to memory of 1924	3856	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinBtn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SkinBtn.dll,#1
  2⤵
  PID:1924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 620
    3⤵
    - Program crash
    PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1924 -ip 1924
1⤵
PID:3972