d4b30c1f2c1f10f46037533e5768b6abba1f60a613e779d871c21abe8ef02d48

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 19:59

Target

$PLUGINSDIR/InstallOptions.dll
Size

30KB
MD5

ff6cb85adb441e639dc58948651d54d2
SHA1

2ba0514b1e64ce4c13c987c30f1b6e61225f192c
SHA256

bbd81555abbfeff33aacdc8c34c307c2eb680953c7f4c4c02b20a8fe10e88bd6
SHA512

bf4c8e862b548011f7d465c82d3c4bc84e7836c4bcd943ffa6dbfbe95d43fc355cf00936cfc4db34822906212bbbc69271f356b74d70051b52cfb9b74f58149d
SSDEEP

384:1/YECOP6qzJH9pBaCxuxux1EnQKGwH1BeIkuK3TqN1fbBxDj0OLxmnWvL:1YZqzJH9pix1NVBnkYpbBr2

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2220	2272	rundll32.exe	28
PID 2272 wrote to memory of 2220	2272	rundll32.exe	28
PID 2272 wrote to memory of 2220	2272	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2272 -s 168
  2⤵
  PID:2220

memory/2272-0-0x000007FEFA5B0000-0x000007FEFA5C4000-memory.dmp

Filesize
80KB

Download