ece8a18ca4213a95ef9b7d6f9bf18b81572c159cf2c7a836d70e2716cc7253da

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2024 12:40

Target

$PLUGINSDIR/InstallOptions.dll
Size

22KB
MD5

17c877fec39fc8ce03b7f012ef25211f
SHA1

61adfa25cbd51375f0355aa9b895e1dc28389e19
SHA256

dbb0173bb09d64ca716b3fd9efb0222ecc7c13c11978d29f2b61cf550bcd7aba
SHA512

45c44c91bf72d058fcba93e7d96b45fcc3dc06855b86eca0f463aa4eeafc7e68493e33663c68fd3fdceed51dd0e76d3493c47da68a3efdc25af9e78c2643d29d
SSDEEP

384:ENC43tPegZ3eBaRwCPOYY7nNYXCg/YosaGqZmZsHLOtNUShHzer:EETgZ3eBTCmrnNAow1OThHzQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4564	464	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 464	3780	rundll32.exe	88
PID 3780 wrote to memory of 464	3780	rundll32.exe	88
PID 3780 wrote to memory of 464	3780	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 636
    3⤵
    - Program crash
    PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 464 -ip 464
1⤵
PID:3152