fbdac75d7e1eeff6598b4498f8395f3adac68c343f1417073527edb6c575e900

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 13:13

Target
$PLUGINSDIR/aminsis.dll
Size 567KB
Sample240204-qf6tfaade2
SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
MD5 450753ad96785a240a39deccab3af0d0
SHA1 21c544064d2ffa6444508268ce258a330d459fc5
SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	2112	WerFault.exe	14

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2112	2088	rundll32.exe	14
PID 2088 wrote to memory of 2112	2088	rundll32.exe	14
PID 2088 wrote to memory of 2112	2088	rundll32.exe	14
PID 2088 wrote to memory of 2112	2088	rundll32.exe	14
PID 2088 wrote to memory of 2112	2088	rundll32.exe	14
PID 2088 wrote to memory of 2112	2088	rundll32.exe	14
PID 2088 wrote to memory of 2112	2088	rundll32.exe	14
PID 2112 wrote to memory of 1744	2112	rundll32.exe	17
PID 2112 wrote to memory of 1744	2112	rundll32.exe	17
PID 2112 wrote to memory of 1744	2112	rundll32.exe	17
PID 2112 wrote to memory of 1744	2112	rundll32.exe	17

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 220
  2⤵
  - Program crash
  PID:1744

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088