5a4be9e92cf84b6fdedef3623c4fc76a9a239e98f88c0c4368bbb72caafdda03

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 11:47

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

2e35876a2b9842d48eed3817809a78eb
SHA1

3e1a36b9758d9e0dabeba65895f4a091f801583e
SHA256

c36d864cd5464add57008985fa901ef4ba32d9831465732b1aa06078a42608d2
SHA512

1776cb43ea9773bf564876e7ba23b05b37b88457f7085622f5d57ebda9886352da5eefba4ab7d44ae16a8a0a0007e1b9fe8b4d22ef0c402e127467070dae0eb9
SSDEEP

192:g4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjHK72dwF7dBOne:Zn3T5KdHCMRD/R1cOnrjH+BO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	3068	WerFault.exe	17

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3068	1264	rundll32.exe	17
PID 1264 wrote to memory of 3068	1264	rundll32.exe	17
PID 1264 wrote to memory of 3068	1264	rundll32.exe	17
PID 1264 wrote to memory of 3068	1264	rundll32.exe	17
PID 1264 wrote to memory of 3068	1264	rundll32.exe	17
PID 1264 wrote to memory of 3068	1264	rundll32.exe	17
PID 1264 wrote to memory of 3068	1264	rundll32.exe	17
PID 3068 wrote to memory of 1100	3068	rundll32.exe	22
PID 3068 wrote to memory of 1100	3068	rundll32.exe	22
PID 3068 wrote to memory of 1100	3068	rundll32.exe	22
PID 3068 wrote to memory of 1100	3068	rundll32.exe	22

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 244
    3⤵
    - Program crash
    PID:1100