477bef4e1ae57d2d0363c5b17bd42354f2bcdd4db538d4d6c001ddaba3c2fd72

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 00:04

Target

baiduclick/SkinH.dll
Size

95KB
MD5

8c00426ffcb551ba07904d9a67843bb4
SHA1

0c1daffaf62497cfa121320b386024a1c18b9be9
SHA256

2c1186029848788fe6fb2ab7cc2a1b9263a872e477344a3483e13ab89604e16c
SHA512

c235ef09f2b96142e062b87df76906c224e7256baabdc0c68d89b52b8603e0d16e6c6c5f98f3fb1fadef5fa117d516ee5ca4e7ecb2a47ecf752db56bd28f732a
SSDEEP

1536:wcK3pX5tPqSI3Hu5FTdQsQrYQRZLHiRdZ2Y+yt7ffSN6kLoy8QPjR87yVJFQsF8h:wcK31I3ApQ9rYQvHedmyVfSN6k78QP5q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2352	2520	WerFault.exe	30

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2520	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2536 wrote to memory of 2520	2536	rundll32.exe	30
PID 2520 wrote to memory of 2352	2520	rundll32.exe	32
PID 2520 wrote to memory of 2352	2520	rundll32.exe	32
PID 2520 wrote to memory of 2352	2520	rundll32.exe	32
PID 2520 wrote to memory of 2352	2520	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\baiduclick\SkinH.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\baiduclick\SkinH.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 244
    3⤵
    - Program crash
    PID:2352

memory/2520-1-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/2520-0-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/2520-4-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/2520-3-0x000000001004E000-0x000000001004F000-memory.dmp

Filesize
4KB

Download
memory/2520-2-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download