03a909dec05f764304e2916f1ad69c0146ce444c952b104e2262a8f107154a3e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 19:35

Target

$PLUGINSDIR/aminsis.dll
Size

834KB
MD5

14ad04243334645f399639b028f21d17
SHA1

7368866dc95621a1407d2105d040da2cc9852ba9
SHA256

02d13f28df1314640474ee77cd202a2c0da8e1d609c614f8fdff4451f8ee63fa
SHA512

3859b6f6e7e46ba70fa0be24fd2ceadf3db746818f11a09109c7bb678ee4fc08824a0cf15c77df09c3b2bdc2a80067a98130660152f5ee61e4bd501ef5ed1728
SSDEEP

24576:SeVFdvT0HpQ/lWfCbFTwjuYktS3mmcQFbxr:rVFd4pQU/qS3mvQF9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1400	1260	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 912 wrote to memory of 1260	912	rundll32.exe	28
PID 1260 wrote to memory of 1400	1260	rundll32.exe	29
PID 1260 wrote to memory of 1400	1260	rundll32.exe	29
PID 1260 wrote to memory of 1400	1260	rundll32.exe	29
PID 1260 wrote to memory of 1400	1260	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 220
    3⤵
    - Program crash
    PID:1400