bef249e9f84cbcd9e19bdc2b610db4b9f72251cb71d4a99f04597019a43416f7

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 15:01

Target
$PLUGINSDIR/InstallOptions.dll
Size 12KB
Sample240224-sd5jpsfh3w
SHA256 435baf3b7282c9110697a4916834ef9371dd29fae6b4cb8e19c19eb126562dc9
MD5 08c82a46416a5e2b471d457968f53816
SHA1 3e3897c20b9e89b279b4764a633f67955bf8f09a
SHA512 91e2055b91d04b2348a923cb298ac6ba3637de5038dc4f849c4d2f1665d17de9cd6eb6a97d42d0f894d65348c8fd8e79cd61b667ea5a78e8960347e8cc8db81d
SSDEEP 384:PKlm7i+c3QW6ckPhyDEaLni2bbBBIXwZ:Sqi8BcyhEhLPbbTI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	2624	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2624	2052	rundll32.exe	28
PID 2052 wrote to memory of 2624	2052	rundll32.exe	28
PID 2052 wrote to memory of 2624	2052	rundll32.exe	28
PID 2052 wrote to memory of 2624	2052	rundll32.exe	28
PID 2052 wrote to memory of 2624	2052	rundll32.exe	28
PID 2052 wrote to memory of 2624	2052	rundll32.exe	28
PID 2052 wrote to memory of 2624	2052	rundll32.exe	28
PID 2624 wrote to memory of 2160	2624	rundll32.exe	29
PID 2624 wrote to memory of 2160	2624	rundll32.exe	29
PID 2624 wrote to memory of 2160	2624	rundll32.exe	29
PID 2624 wrote to memory of 2160	2624	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 248
    3⤵
    - Program crash
    PID:2160