28411261cb3f27081f910190d1c7742fb805185430af10131d5b39fd2e39c832

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 06:05

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

14c212bb2fa90fe52a6424b955c86ad6
SHA1

9e94f8ad17ff9b6b31e5f029ee5f726e307ac8ee
SHA256

1854afccace3053dca2707b10609ea78a30f0ee853bdb9f251c076317ee53120
SHA512

d42fa579f93b98d1446daf3d0734c19838fa310ef27cd05344e25d9f86ba37a5fa1752236e5de4df7c9f414236538bd7431bffda126fb9c74fd112539de0e713
SSDEEP

192:Rc6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTPK72dwF7dBdcQOz:m6JaVh4I5rpPbTP+BdhO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2496	3020	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 3020	1956	rundll32.exe	28
PID 1956 wrote to memory of 3020	1956	rundll32.exe	28
PID 1956 wrote to memory of 3020	1956	rundll32.exe	28
PID 1956 wrote to memory of 3020	1956	rundll32.exe	28
PID 1956 wrote to memory of 3020	1956	rundll32.exe	28
PID 1956 wrote to memory of 3020	1956	rundll32.exe	28
PID 1956 wrote to memory of 3020	1956	rundll32.exe	28
PID 3020 wrote to memory of 2496	3020	rundll32.exe	29
PID 3020 wrote to memory of 2496	3020	rundll32.exe	29
PID 3020 wrote to memory of 2496	3020	rundll32.exe	29
PID 3020 wrote to memory of 2496	3020	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 248
    3⤵
    - Program crash
    PID:2496