156dc2cc55c7636cea6678af157b9cb86a761854683109ddd6e9a5565bac5b73 | Triage

Analysis

max time kernel
129s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 16:23

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/amkldwh.dll
Size

161KB
MD5

754dc4c309b70c5233f365d15676b12c
SHA1

83ab7f44f805ec9ef5919ab3b8cc957b5eb60f1a
SHA256

627cd775a522bd3a5bccbfdda2c6f67741def34c03c1949ce58c8b5b01581d65
SHA512

ab8a6d5456d4696989e1fe8aef27010277a4461edbe7aa89fe12632321f6534a883819d2b0535896080aacc71f850c00c14f4b4adfac927e570411682b1d1fd4
SSDEEP

3072:Gq3ZSxgOf6M8CvGLKBdz+tVdQbwzmZJcO:/cjfvGLKHdo0Jc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1920	3228	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3228	2360	rundll32.exe	87
PID 2360 wrote to memory of 3228	2360	rundll32.exe	87
PID 2360 wrote to memory of 3228	2360	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\amkldwh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\amkldwh.dll,#1
  2⤵
  PID:3228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 600
    3⤵
    - Program crash
    PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3228 -ip 3228
1⤵
PID:864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads