e791985263b2df4b00652a69f4d6ac925dd2e7a069b9cc30ccb6fc5c813ec44b

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 03:10

Target

$PLUGINSDIR/InstallOptions.dll
Size

15KB
MD5

6e663f1a0de94bc05d64d020da5d6f36
SHA1

c5abb0033776d6ab1f07e5b3568f7d64f90e5b04
SHA256

458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4
SHA512

2a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5
SSDEEP

192:VsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5mj8ozxGUWumle:VsUHd9GN2d2iwl0impATIPdAj8Ov6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
3044	2264	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2264	2904	rundll32.exe	2
PID 2904 wrote to memory of 2264	2904	rundll32.exe	2
PID 2904 wrote to memory of 2264	2904	rundll32.exe	2
PID 2904 wrote to memory of 2264	2904	rundll32.exe	2
PID 2904 wrote to memory of 2264	2904	rundll32.exe	2
PID 2904 wrote to memory of 2264	2904	rundll32.exe	2
PID 2904 wrote to memory of 2264	2904	rundll32.exe	2
PID 2264 wrote to memory of 3044	2264	rundll32.exe	1
PID 2264 wrote to memory of 3044	2264	rundll32.exe	1
PID 2264 wrote to memory of 3044	2264	rundll32.exe	1
PID 2264 wrote to memory of 3044	2264	rundll32.exe	1

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 248
1⤵
- Program crash
PID:3044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904