227bf0630733000e3b1a47e72459153a4fee173a648da5b2d35f2cabe4ddc147

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 06:26

Target

$PLUGINSDIR/amkldwh.dll
Size

161KB
MD5

754dc4c309b70c5233f365d15676b12c
SHA1

83ab7f44f805ec9ef5919ab3b8cc957b5eb60f1a
SHA256

627cd775a522bd3a5bccbfdda2c6f67741def34c03c1949ce58c8b5b01581d65
SHA512

ab8a6d5456d4696989e1fe8aef27010277a4461edbe7aa89fe12632321f6534a883819d2b0535896080aacc71f850c00c14f4b4adfac927e570411682b1d1fd4
SSDEEP

3072:Gq3ZSxgOf6M8CvGLKBdz+tVdQbwzmZJcO:/cjfvGLKHdo0Jc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2616	2108	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 308 wrote to memory of 2108	308	rundll32.exe	28
PID 2108 wrote to memory of 2616	2108	rundll32.exe	29
PID 2108 wrote to memory of 2616	2108	rundll32.exe	29
PID 2108 wrote to memory of 2616	2108	rundll32.exe	29
PID 2108 wrote to memory of 2616	2108	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\amkldwh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\amkldwh.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 220
    3⤵
    - Program crash
    PID:2616