d00136f53e9a79326ca0f0979bdcad1492efb6216daa07a14939503c82cc9e8b | Triage

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/InstallOptions.dll
Size

17KB
MD5

dfb63c8be09cc3ee878ae45ed1080ddd
SHA1

3e29a861ed54787c3e7419cdb296bd8472788a32
SHA256

ebe69bd40f33c8a7571a235984295afdadda2905b7a893e373c1da5d25d9f0b6
SHA512

a1f9e98a5d4a842bb29ab86362f5a42c88d87c2b905e3391038b7e12903858ced68b0bf350af70ba46f2800b7babf56ca646d0eeffb19320ed924b4b03690f75
SSDEEP

384:Nv26sCpKYobPUWeo42Nt++zCiSBTRRw3HbPhvaUM:NvYGKLPUBo42Kpr61ax

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	3840	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3840	5016	rundll32.exe	85
PID 5016 wrote to memory of 3840	5016	rundll32.exe	85
PID 5016 wrote to memory of 3840	5016	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 636
    3⤵
    - Program crash
    PID:1640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3840 -ip 3840
1⤵
PID:3528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3840-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download