Overview
overview
7Static
static
3VirusShare...5e.exe
windows7-x64
7VirusShare...5e.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3ffMediaWat...ion.js
windows7-x64
1ffMediaWat...ion.js
windows10-2004-x64
1ff/chrome/...747.js
windows7-x64
1ff/chrome/...747.js
windows10-2004-x64
1ff/chrome/...ion.js
windows7-x64
1ff/chrome/...ion.js
windows10-2004-x64
1ie/MediaWa...47.dll
windows7-x64
6ie/MediaWa...47.dll
windows10-2004-x64
6uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 16:19
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_a8c1c370bc3667f8ab42733e0473125e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
VirusShare_a8c1c370bc3667f8ab42733e0473125e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
ffMediaWatchV1home1747chaction.js
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
ffMediaWatchV1home1747chaction.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
ff/chrome/content/ffMediaWatchV1home1747.js
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
ff/chrome/content/ffMediaWatchV1home1747.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
ff/chrome/content/ffMediaWatchV1home1747ffaction.js
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
ff/chrome/content/ffMediaWatchV1home1747ffaction.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
ie/MediaWatchV1home1747.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
ie/MediaWatchV1home1747.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20231222-en
General
-
Target
$PLUGINSDIR/aminsis.dll
-
Size
559KB
-
MD5
51ba1095f0ae45a2d444bea506cb9ad4
-
SHA1
038a5d53d055a6d440bd2c8864c2f51db206c5e5
-
SHA256
b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
-
SHA512
f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
-
SSDEEP
12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4056 4128 WerFault.exe 17 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4468 wrote to memory of 4128 4468 rundll32.exe 17 PID 4468 wrote to memory of 4128 4468 rundll32.exe 17 PID 4468 wrote to memory of 4128 4468 rundll32.exe 17
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#12⤵PID:4128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 6243⤵
- Program crash
PID:4056
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4128 -ip 41281⤵PID:4192