156dc2cc55c7636cea6678af157b9cb86a761854683109ddd6e9a5565bac5b73

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 16:23

Target

$PLUGINSDIR/amkldwh.dll
Size

161KB
MD5

754dc4c309b70c5233f365d15676b12c
SHA1

83ab7f44f805ec9ef5919ab3b8cc957b5eb60f1a
SHA256

627cd775a522bd3a5bccbfdda2c6f67741def34c03c1949ce58c8b5b01581d65
SHA512

ab8a6d5456d4696989e1fe8aef27010277a4461edbe7aa89fe12632321f6534a883819d2b0535896080aacc71f850c00c14f4b4adfac927e570411682b1d1fd4
SSDEEP

3072:Gq3ZSxgOf6M8CvGLKBdz+tVdQbwzmZJcO:/cjfvGLKHdo0Jc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1656	2348	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2360 wrote to memory of 2348	2360	rundll32.exe	28
PID 2348 wrote to memory of 1656	2348	rundll32.exe	29
PID 2348 wrote to memory of 1656	2348	rundll32.exe	29
PID 2348 wrote to memory of 1656	2348	rundll32.exe	29
PID 2348 wrote to memory of 1656	2348	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\amkldwh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\amkldwh.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 220
    3⤵
    - Program crash
    PID:1656