c306ae721c046eb3246e863b7bd4f1fdecb4dac5c1ed04c06f29c582443a389c | Triage

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:33

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/InstallOptions.dll
Size

12KB
MD5

10f710e8bb6259592a4b5874f0a554c6
SHA1

b6e5df9276a1c8717cc05b3f71dbb13b90de5e0e
SHA256

5e7bc15c54fce6d02cc0b5bd4c14838f7f5cab3fda5dacd3d128bd22d78a4f31
SHA512

75df142db5d8aac1b9b8dc72ee2c7ae9531c742e452df3bd12b94fbfecc901b5890f579f38d4f577dfc80e829d3d80fe1c4c0aeedf619e5b6d37f1cd38a22f98
SSDEEP

384:2Klm7i+c3QW6ckPhyDEaLnx2bbBBIXwZ:7qi8BcyhEhL0bbTI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2312 2376 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2780 wrote to memory of 2376	2780	rundll32.exe	rundll32.exe
PID 2780 wrote to memory of 2376	2780	rundll32.exe	rundll32.exe
PID 2780 wrote to memory of 2376	2780	rundll32.exe	rundll32.exe
PID 2780 wrote to memory of 2376	2780	rundll32.exe	rundll32.exe
PID 2780 wrote to memory of 2376	2780	rundll32.exe	rundll32.exe
PID 2780 wrote to memory of 2376	2780	rundll32.exe	rundll32.exe
PID 2780 wrote to memory of 2376	2780	rundll32.exe	rundll32.exe
PID 2376 wrote to memory of 2312	2376	rundll32.exe	WerFault.exe
PID 2376 wrote to memory of 2312	2376	rundll32.exe	WerFault.exe
PID 2376 wrote to memory of 2312	2376	rundll32.exe	WerFault.exe
PID 2376 wrote to memory of 2312	2376	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 248
3⤵
- Program crash
PID:2312

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...