8c42da25a2b1de27ed2ee529bc0b1e6c126baaddc10c8e9401aa7c3d0df63d50 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 11:43

Sharing

Report Analysis Logs

General

Target

SkinMagic.dll
Size

476KB
MD5

59e53588f0a12d54bf1b0b24182d098f
SHA1

857f40508d08dfbeb26afc46601cad32fe1414b7
SHA256

886c9d39ace6e0d914cd97a1a1233be51c4a201c22f6cc4861e7c0d90ac895ef
SHA512

4cf12296de0273cf715cc3f9997ca97afff2cbb58327b62735100e33f38068444aa90a99b77d756990a816a57ce5bc5a040e1db9c2e5944b01e4a3211574f049
SSDEEP

12288:jTKUXiZ222S+P01CDDnrUyRo2d8x3Ti+CBis9T:ViZeNP0ofrUyR58x3FCis9T

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2376	2484	rundll32.exe	30
PID 2484 wrote to memory of 2376	2484	rundll32.exe	30
PID 2484 wrote to memory of 2376	2484	rundll32.exe	30
PID 2484 wrote to memory of 2376	2484	rundll32.exe	30
PID 2484 wrote to memory of 2376	2484	rundll32.exe	30
PID 2484 wrote to memory of 2376	2484	rundll32.exe	30
PID 2484 wrote to memory of 2376	2484	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SkinMagic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SkinMagic.dll,#1
  2⤵
  PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads