477bef4e1ae57d2d0363c5b17bd42354f2bcdd4db538d4d6c001ddaba3c2fd72

Analysis

max time kernel
93s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 00:04

Target

baiduclick/SkinH.dll
Size

95KB
MD5

8c00426ffcb551ba07904d9a67843bb4
SHA1

0c1daffaf62497cfa121320b386024a1c18b9be9
SHA256

2c1186029848788fe6fb2ab7cc2a1b9263a872e477344a3483e13ab89604e16c
SHA512

c235ef09f2b96142e062b87df76906c224e7256baabdc0c68d89b52b8603e0d16e6c6c5f98f3fb1fadef5fa117d516ee5ca4e7ecb2a47ecf752db56bd28f732a
SSDEEP

1536:wcK3pX5tPqSI3Hu5FTdQsQrYQRZLHiRdZ2Y+yt7ffSN6kLoy8QPjR87yVJFQsF8h:wcK31I3ApQ9rYQvHedmyVfSN6k78QP5q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4412	4820	WerFault.exe	83

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4820	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4820	2748	rundll32.exe	83
PID 2748 wrote to memory of 4820	2748	rundll32.exe	83
PID 2748 wrote to memory of 4820	2748	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\baiduclick\SkinH.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\baiduclick\SkinH.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 644
    3⤵
    - Program crash
    PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4820 -ip 4820
1⤵
PID:1612

memory/4820-0-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/4820-1-0x0000000010001000-0x0000000010038000-memory.dmp

Filesize
220KB

Download
memory/4820-2-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/4820-3-0x0000000010000000-0x0000000010054000-memory.dmp

Filesize
336KB

Download
memory/4820-4-0x0000000010001000-0x0000000010038000-memory.dmp

Filesize
220KB

Download