5a4be9e92cf84b6fdedef3623c4fc76a9a239e98f88c0c4368bbb72caafdda03

Analysis

max time kernel
109s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 11:47

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

2e35876a2b9842d48eed3817809a78eb
SHA1

3e1a36b9758d9e0dabeba65895f4a091f801583e
SHA256

c36d864cd5464add57008985fa901ef4ba32d9831465732b1aa06078a42608d2
SHA512

1776cb43ea9773bf564876e7ba23b05b37b88457f7085622f5d57ebda9886352da5eefba4ab7d44ae16a8a0a0007e1b9fe8b4d22ef0c402e127467070dae0eb9
SSDEEP

192:g4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjHK72dwF7dBOne:Zn3T5KdHCMRD/R1cOnrjH+BO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	4872	WerFault.exe	17

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4872	3828	rundll32.exe	17
PID 3828 wrote to memory of 4872	3828	rundll32.exe	17
PID 3828 wrote to memory of 4872	3828	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 636
    3⤵
    - Program crash
    PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4872 -ip 4872
1⤵
PID:1180