ff31fc1cbcfb9b8419df83dd77a3cde29071b3e5873025769e8ed2476d0f2c87

Analysis

max time kernel
183s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:39

Target

SkinH.dll
Size

95KB
MD5

8c00426ffcb551ba07904d9a67843bb4
SHA1

0c1daffaf62497cfa121320b386024a1c18b9be9
SHA256

2c1186029848788fe6fb2ab7cc2a1b9263a872e477344a3483e13ab89604e16c
SHA512

c235ef09f2b96142e062b87df76906c224e7256baabdc0c68d89b52b8603e0d16e6c6c5f98f3fb1fadef5fa117d516ee5ca4e7ecb2a47ecf752db56bd28f732a
SSDEEP

1536:wcK3pX5tPqSI3Hu5FTdQsQrYQRZLHiRdZ2Y+yt7ffSN6kLoy8QPjR87yVJFQsF8h:wcK31I3ApQ9rYQvHedmyVfSN6k78QP5q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	2892	WerFault.exe	89

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2892	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 2892	4672	rundll32.exe	89
PID 4672 wrote to memory of 2892	4672	rundll32.exe	89
PID 4672 wrote to memory of 2892	4672	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SkinH.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SkinH.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 644
    3⤵
    - Program crash
    PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2892 -ip 2892
1⤵
PID:1840

memory/2892-0-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/2892-1-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/2892-2-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/2892-3-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download