3f4ce9bf7e90520781cb7945b436cb0d8f33884606ecd588fd1864d597972c63 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 23:52

Sharing

Report Analysis Logs

General

Target

aminstall.dll
Size

124KB
MD5

2ec42398e55da7ef94b72261b9a598ea
SHA1

ebb8ea2af408b985117930b214b3ac9fb9bfb27c
SHA256

a5240dd109c8721f3d8b0279375dff0044c5461cf68306eae9267fa122f0caf1
SHA512

c5532c8f7628c56f2aebd311261202b3764d1a04111dc90040de9711f7df49dfc71fd9b674b1d9251052bafec0b6dff9f9b49ec79fa2fb484fda7891905edb77
SSDEEP

3072:N5ejXjok9otaxPAWe3TBfywbl0UjpXwtep6+BR:N4jMk9ot0AWe3TBJeUSMR

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4268	852	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 852	4960	rundll32.exe	82
PID 4960 wrote to memory of 852	4960	rundll32.exe	82
PID 4960 wrote to memory of 852	4960	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aminstall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aminstall.dll,#1
  2⤵
  PID:852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 616
    3⤵
    - Program crash
    PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 852 -ip 852
1⤵
PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads