0f703b86e8b9e8572c16e37dc7d983567e143e45d2aea03112353f29db7ffd4b

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 20:19

Target

SkinSE.dll
Size

912KB
MD5

535529273df381303b2131d4e849e365
SHA1

1a8697955b1ffb2bcc51ea4d547aa89afb698cf8
SHA256

40f77ef4ae16863ff4e817d8da57e89f4b4eaef6560b10ba31727726c1d5d00d
SHA512

7592f5d99d933e0b0e886dc60db8e536c0290b496df482aa20c1a880673ed32700f3281aa57a7378e8905138fc3c32d5eea301f1ec034e94bba68fd5bebd33fd
SSDEEP

24576:nYvsPHKc+ml7OaPrGNRDox4HH34hsRc78YrESp/r2LnaDZJ3yFxo+SPpFLbKcTfN:96P7FxoRF7T9Yg

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2236 wrote to memory of 1664	2236	rundll32.exe	28
PID 2236 wrote to memory of 1664	2236	rundll32.exe	28
PID 2236 wrote to memory of 1664	2236	rundll32.exe	28
PID 2236 wrote to memory of 1664	2236	rundll32.exe	28
PID 2236 wrote to memory of 1664	2236	rundll32.exe	28
PID 2236 wrote to memory of 1664	2236	rundll32.exe	28
PID 2236 wrote to memory of 1664	2236	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SkinSE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SkinSE.dll,#1
  2⤵
  PID:1664

memory/1664-4-0x000000001001D000-0x000000001001E000-memory.dmp

Filesize
4KB

Download
memory/1664-5-0x000000001001D000-0x000000001001E000-memory.dmp

Filesize
4KB

Download
memory/1664-3-0x000000001001D000-0x000000001001E000-memory.dmp

Filesize
4KB

Download
memory/1664-2-0x000000001001D000-0x000000001001E000-memory.dmp

Filesize
4KB

Download
memory/1664-1-0x000000001001D000-0x000000001001E000-memory.dmp

Filesize
4KB

Download
memory/1664-0-0x000000001001D000-0x000000001001E000-memory.dmp

Filesize
4KB

Download