e86ddd63bce81ceda1e30756ea9cea3cd87fb7fb9f6870992fdae4240346fe20

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 17:23

Target

"aminstall.dll
Size

76KB
MD5

b91f126675ef39f4ee46f877e230d255
SHA1

2411fed6cbaf6cd80fbd374fa0af18a1280ec9b8
SHA256

803606254069701d1e5e05cc7a5e98292145c42549d224e323be17b24d80c441
SHA512

05e352cbb2f770a3a17021b9beb08877d14ab333c928b8bf0f393c5bd6a738fac4453e7661e5ad3340e886f3461a2050191a0284b1de8f761b2d6974703bb58c
SSDEEP

768:MNV5rhiqaZ1V7V5yytiCLqmfTKeqvi8NT7jypjGZ1wZgH1Y10BlnkE52zGnApuxo:Mf5hgVXyy1luTXyVMwW1NkEQGnAp1cO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3480	3948	WerFault.exe	95

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 3948	4080	rundll32.exe	95
PID 4080 wrote to memory of 3948	4080	rundll32.exe	95
PID 4080 wrote to memory of 3948	4080	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\_aminstall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\_aminstall.dll,#1
  2⤵
  PID:3948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 616
    3⤵
    - Program crash
    PID:3480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3948 -ip 3948
1⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:1996