a6eb7a7372c462b2e181014540491a062c540edc4ba0f65a9169cfbfb473e6c7

Analysis

max time kernel
92s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 07:17

Target

$PLUGINSDIR/installer-helper.dll
Size

145KB
MD5

bfde6b61201b95a2892e63adfce22769
SHA1

7eebee84f7867b4135f361d4a046cdc05a764cdc
SHA256

9f6363712ce45c4a09e5b1c35271eea64ea160f6ed5679bf809ad257cba51bbf
SHA512

1f877e7e90ec1d91667d4da476b83b0a0bea0cf160a97006219332fa1201ab2bf79a65aa54f3e38a1ffd8ba19074c9ac1a0e3a4ca8c20f131a538cccc1fdd9bd
SSDEEP

3072:wyneNtV1mFWTcb7JiU9g9Nnsed92uL/d5+4iZ:wye/VcsTcd9grsgcuL/O4iZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2888	2336	WerFault.exe	86

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	rundll32.exe
Token: SeLoadDriverPrivilege	2336	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 2336	1076	rundll32.exe	86
PID 1076 wrote to memory of 2336	1076	rundll32.exe	86
PID 1076 wrote to memory of 2336	1076	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installer-helper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installer-helper.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 644
    3⤵
    - Program crash
    PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2336 -ip 2336
1⤵
PID:3428