ab302c5c241aa7fee3d6fcce7dc5cb71ee1a0588788a2892f251f37b1081233d

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 13:07

Target

$PLUGINSDIR/aminsis.dll
Size

567KB
MD5

450753ad96785a240a39deccab3af0d0
SHA1

21c544064d2ffa6444508268ce258a330d459fc5
SHA256

1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
SHA512

c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP

12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2680	1200	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1200	2344	rundll32.exe	27
PID 2344 wrote to memory of 1200	2344	rundll32.exe	27
PID 2344 wrote to memory of 1200	2344	rundll32.exe	27
PID 2344 wrote to memory of 1200	2344	rundll32.exe	27
PID 2344 wrote to memory of 1200	2344	rundll32.exe	27
PID 2344 wrote to memory of 1200	2344	rundll32.exe	27
PID 2344 wrote to memory of 1200	2344	rundll32.exe	27
PID 1200 wrote to memory of 2680	1200	rundll32.exe	28
PID 1200 wrote to memory of 2680	1200	rundll32.exe	28
PID 1200 wrote to memory of 2680	1200	rundll32.exe	28
PID 1200 wrote to memory of 2680	1200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 224
    3⤵
    - Program crash
    PID:2680