7882eab29859c18474d3674f7802e17c2c78616f3dc9c5afbba04bd30db1b213

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 19:03

Target

CAD迷你画图/SkinControls.dll
Size

137KB
MD5

6d01a6c7d6d1f37c07aba23485fcb214
SHA1

384f2c2e13e5ead09216ba474091b841f3de06c3
SHA256

fde851c24cc7d9437632182545c104addfb4e84f71896fcf276f2df1f61376d0
SHA512

4f3edb4676c828b9e32921f13e0cc00e7ac080dd458c616fe41ce3927cdaff4b2ebffe9a98c0bb13893468d354379e03586497e2723aa02fb6144f8120a18d65
SSDEEP

3072:QoGlwbDSqZAVOsKmY2s29IgOBvpIMxCZHnUpa5Lc:QoGOy0sKmHOBvpOZH6gc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
236	2280	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	Process	procid_target
PID 2120 wrote to memory of 2280	2120	rundll32.exe	31
PID 2120 wrote to memory of 2280	2120	rundll32.exe	31
PID 2120 wrote to memory of 2280	2120	rundll32.exe	31
PID 2120 wrote to memory of 2280	2120	rundll32.exe	31
PID 2120 wrote to memory of 2280	2120	rundll32.exe	31
PID 2120 wrote to memory of 2280	2120	rundll32.exe	31
PID 2120 wrote to memory of 2280	2120	rundll32.exe	31
PID 2280 wrote to memory of 236	2280	rundll32.exe	32
PID 2280 wrote to memory of 236	2280	rundll32.exe	32
PID 2280 wrote to memory of 236	2280	rundll32.exe	32
PID 2280 wrote to memory of 236	2280	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\SkinControls.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CAD迷你画图\SkinControls.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 228
    3⤵
    - Program crash
    PID:236