debf351be78e09aba6a74dd649077d4b7ed011f244b6e0e0ab3c75577828862f

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 08:24

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

14c212bb2fa90fe52a6424b955c86ad6
SHA1

9e94f8ad17ff9b6b31e5f029ee5f726e307ac8ee
SHA256

1854afccace3053dca2707b10609ea78a30f0ee853bdb9f251c076317ee53120
SHA512

d42fa579f93b98d1446daf3d0734c19838fa310ef27cd05344e25d9f86ba37a5fa1752236e5de4df7c9f414236538bd7431bffda126fb9c74fd112539de0e713
SSDEEP

192:Rc6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTPK72dwF7dBdcQOz:m6JaVh4I5rpPbTP+BdhO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	2296	WerFault.exe	21

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2296	3016	rundll32.exe	21
PID 3016 wrote to memory of 2296	3016	rundll32.exe	21
PID 3016 wrote to memory of 2296	3016	rundll32.exe	21
PID 3016 wrote to memory of 2296	3016	rundll32.exe	21
PID 3016 wrote to memory of 2296	3016	rundll32.exe	21
PID 3016 wrote to memory of 2296	3016	rundll32.exe	21
PID 3016 wrote to memory of 2296	3016	rundll32.exe	21
PID 2296 wrote to memory of 2324	2296	rundll32.exe	28
PID 2296 wrote to memory of 2324	2296	rundll32.exe	28
PID 2296 wrote to memory of 2324	2296	rundll32.exe	28
PID 2296 wrote to memory of 2324	2296	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 248
    3⤵
    - Program crash
    PID:2324