dbb53b0f2c9c2a6af84fb791a00540f9af056474ac067579440c80912b8f2e50

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 20:14

Target

$PLUGINSDIR/InstallOptions.dll
Size

15KB
MD5

828a94a3b9a080f79e84015b55fce227
SHA1

c15c615925bb72531ba32194253eefa49edaa93a
SHA256

1d0a17641f697203fd0c0b9ba0b715436299203c9c1be90c458fe668a1eb68d2
SHA512

c3d41a3f9377a8c18a85eec50a3eb3cf5a4ec8ea4bbffd73992455cb01aaed9f158183bc647684f82c516534266a46ccfcd7c2c0b3e1b73774c3bedc9e80054a
SSDEEP

192:1sIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5mT8ozxGUWumle:1sUHd9GN2d2iwl0impATIPdAT8Ov6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2052	1780	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1780	2088	rundll32.exe	28
PID 2088 wrote to memory of 1780	2088	rundll32.exe	28
PID 2088 wrote to memory of 1780	2088	rundll32.exe	28
PID 2088 wrote to memory of 1780	2088	rundll32.exe	28
PID 2088 wrote to memory of 1780	2088	rundll32.exe	28
PID 2088 wrote to memory of 1780	2088	rundll32.exe	28
PID 2088 wrote to memory of 1780	2088	rundll32.exe	28
PID 1780 wrote to memory of 2052	1780	rundll32.exe	29
PID 1780 wrote to memory of 2052	1780	rundll32.exe	29
PID 1780 wrote to memory of 2052	1780	rundll32.exe	29
PID 1780 wrote to memory of 2052	1780	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 244
    3⤵
    - Program crash
    PID:2052