dbb53b0f2c9c2a6af84fb791a00540f9af056474ac067579440c80912b8f2e50

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 20:14

Target

$PLUGINSDIR/InstallOptions.dll
Size

15KB
MD5

828a94a3b9a080f79e84015b55fce227
SHA1

c15c615925bb72531ba32194253eefa49edaa93a
SHA256

1d0a17641f697203fd0c0b9ba0b715436299203c9c1be90c458fe668a1eb68d2
SHA512

c3d41a3f9377a8c18a85eec50a3eb3cf5a4ec8ea4bbffd73992455cb01aaed9f158183bc647684f82c516534266a46ccfcd7c2c0b3e1b73774c3bedc9e80054a
SSDEEP

192:1sIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5mT8ozxGUWumle:1sUHd9GN2d2iwl0impATIPdAT8Ov6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
64	4932	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 4932	2292	rundll32.exe	87
PID 2292 wrote to memory of 4932	2292	rundll32.exe	87
PID 2292 wrote to memory of 4932	2292	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 636
    3⤵
    - Program crash
    PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4932 -ip 4932
1⤵
PID:792