531313033fdb71c44c0791f56679e55c36f06fa6250f90f68ebaf42e7a2a044b

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 06:29

Target

$PLUGINSDIR/BDMSkin.dll
Size

1.8MB
MD5

3f6dc271f034861cb4be850a816105e3
SHA1

d83f7a11d47d4668737ff64139870bad8a8722a0
SHA256

4f5d4dc959ccb0f201b2f2c761c74f6284ec90fe4d05e11813c63f584356205a
SHA512

2149b342a8bb8486faf3e7ffe43b6fe66bad4b93512ed668caccdf63399a48411b92b31c99a018c92e4590584d8c0111a483f8161ec179d5f92aba2e398fa76a
SSDEEP

24576:l6HdOqkMfbZu853MkOiJnzC5LLpjA1Mr7zcy9apk/:lidxZuI3EL5A1y7zcy9apk/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2376	2484	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2484	2352	rundll32.exe	30
PID 2352 wrote to memory of 2484	2352	rundll32.exe	30
PID 2352 wrote to memory of 2484	2352	rundll32.exe	30
PID 2352 wrote to memory of 2484	2352	rundll32.exe	30
PID 2352 wrote to memory of 2484	2352	rundll32.exe	30
PID 2352 wrote to memory of 2484	2352	rundll32.exe	30
PID 2352 wrote to memory of 2484	2352	rundll32.exe	30
PID 2484 wrote to memory of 2376	2484	rundll32.exe	31
PID 2484 wrote to memory of 2376	2484	rundll32.exe	31
PID 2484 wrote to memory of 2376	2484	rundll32.exe	31
PID 2484 wrote to memory of 2376	2484	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMSkin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\BDMSkin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 280
    3⤵
    - Program crash
    PID:2376