c291f69fe2c0a95a9949ac15d06182344d646cf591752e0db27e2a09c90a97e6 | Triage

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 10:12

Sharing

Report Analysis Logs

General

Target

amd_ags_x64.dll
Size

106KB
MD5

b94ed14aaf252885f75e9132abc9d389
SHA1

6726078611731d38f032dcef8a522b64fa7d56f7
SHA256

37bf20436643db1e483fc44a20ff5ec50abaf0c6a863a2eafaac03e9e5cdbd27
SHA512

42eb3abe04bc66117da1647793d71f01da496cec77667ec6c77ca6c365be6a4e09288588681f113c65662090729ed15e7b2e3000191aad91b5c885b686596c7e
SSDEEP

3072:6EcW2rxb5FjFT2HVMrUG1B86bkUy3KiI:32rxFbTUMweBlbknA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1680	1928	rundll32.exe	28
PID 1928 wrote to memory of 1680	1928	rundll32.exe	28
PID 1928 wrote to memory of 1680	1928	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\amd_ags_x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1928 -s 80
  2⤵
  PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads