1fd0eb5a0bde40999118afa7beb7e99d43ba60eeba41d3100c8af08c00dc3aa4

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 01:35

Target

aminstall.dll
Size

76KB
MD5

b91f126675ef39f4ee46f877e230d255
SHA1

2411fed6cbaf6cd80fbd374fa0af18a1280ec9b8
SHA256

803606254069701d1e5e05cc7a5e98292145c42549d224e323be17b24d80c441
SHA512

05e352cbb2f770a3a17021b9beb08877d14ab333c928b8bf0f393c5bd6a738fac4453e7661e5ad3340e886f3461a2050191a0284b1de8f761b2d6974703bb58c
SSDEEP

768:MNV5rhiqaZ1V7V5yytiCLqmfTKeqvi8NT7jypjGZ1wZgH1Y10BlnkE52zGnApuxo:Mf5hgVXyy1luTXyVMwW1NkEQGnAp1cO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5060	716	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 716	2248	rundll32.exe	80
PID 2248 wrote to memory of 716	2248	rundll32.exe	80
PID 2248 wrote to memory of 716	2248	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aminstall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aminstall.dll,#1
  2⤵
  PID:716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 616
    3⤵
    - Program crash
    PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 716 -ip 716
1⤵
PID:4428