ece8a18ca4213a95ef9b7d6f9bf18b81572c159cf2c7a836d70e2716cc7253da

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-03-2024 12:40

Target

$PLUGINSDIR/InstallOptions.dll
Size

22KB
MD5

17c877fec39fc8ce03b7f012ef25211f
SHA1

61adfa25cbd51375f0355aa9b895e1dc28389e19
SHA256

dbb0173bb09d64ca716b3fd9efb0222ecc7c13c11978d29f2b61cf550bcd7aba
SHA512

45c44c91bf72d058fcba93e7d96b45fcc3dc06855b86eca0f463aa4eeafc7e68493e33663c68fd3fdceed51dd0e76d3493c47da68a3efdc25af9e78c2643d29d
SSDEEP

384:ENC43tPegZ3eBaRwCPOYY7nNYXCg/YosaGqZmZsHLOtNUShHzer:EETgZ3eBTCmrnNAow1OThHzQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	1528	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1528	2212	rundll32.exe	28
PID 2212 wrote to memory of 1528	2212	rundll32.exe	28
PID 2212 wrote to memory of 1528	2212	rundll32.exe	28
PID 2212 wrote to memory of 1528	2212	rundll32.exe	28
PID 2212 wrote to memory of 1528	2212	rundll32.exe	28
PID 2212 wrote to memory of 1528	2212	rundll32.exe	28
PID 2212 wrote to memory of 1528	2212	rundll32.exe	28
PID 1528 wrote to memory of 1944	1528	rundll32.exe	29
PID 1528 wrote to memory of 1944	1528	rundll32.exe	29
PID 1528 wrote to memory of 1944	1528	rundll32.exe	29
PID 1528 wrote to memory of 1944	1528	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 244
    3⤵
    - Program crash
    PID:1944