e86ddd63bce81ceda1e30756ea9cea3cd87fb7fb9f6870992fdae4240346fe20

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 17:23

Target

"aminstall.dll
Size

76KB
MD5

b91f126675ef39f4ee46f877e230d255
SHA1

2411fed6cbaf6cd80fbd374fa0af18a1280ec9b8
SHA256

803606254069701d1e5e05cc7a5e98292145c42549d224e323be17b24d80c441
SHA512

05e352cbb2f770a3a17021b9beb08877d14ab333c928b8bf0f393c5bd6a738fac4453e7661e5ad3340e886f3461a2050191a0284b1de8f761b2d6974703bb58c
SSDEEP

768:MNV5rhiqaZ1V7V5yytiCLqmfTKeqvi8NT7jypjGZ1wZgH1Y10BlnkE52zGnApuxo:Mf5hgVXyy1luTXyVMwW1NkEQGnAp1cO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1660	1908	rundll32.exe	28
PID 1908 wrote to memory of 1660	1908	rundll32.exe	28
PID 1908 wrote to memory of 1660	1908	rundll32.exe	28
PID 1908 wrote to memory of 1660	1908	rundll32.exe	28
PID 1908 wrote to memory of 1660	1908	rundll32.exe	28
PID 1908 wrote to memory of 1660	1908	rundll32.exe	28
PID 1908 wrote to memory of 1660	1908	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_aminstall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_aminstall.dll,#1
  2⤵
  PID:1660