e5a4f00a5050fd2f029b4bacba9fc79c65e8f74809ee53eda02e2059352811d7

Analysis

max time kernel
142s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 00:59

Target

$PLUGINSDIR/InstallOptions.dll
Size

16KB
MD5

81d523c4efc5d93891c76e90ec740089
SHA1

4d8e7eb2702086d5ca7b9ed4e2ba29dd2409a380
SHA256

62f96f93647ab30a7ee7a545e787084169f890a693f9fc5a8775143008aa6254
SHA512

52229a466aee9929cd47bffd763b96a7bc1aa394651593e1738e339ba64d2bac1a8148ff3f4f69911a7786cb717932175fdd136879c38fb1234b28def9ed357c
SSDEEP

384:l9SqLB/A3UNWH+E0cH+1l+ar3ipEn6eF:rSsB/eiWH+oH+uOZ6eF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	1660	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1660	2256	rundll32.exe	28
PID 2256 wrote to memory of 1660	2256	rundll32.exe	28
PID 2256 wrote to memory of 1660	2256	rundll32.exe	28
PID 2256 wrote to memory of 1660	2256	rundll32.exe	28
PID 2256 wrote to memory of 1660	2256	rundll32.exe	28
PID 2256 wrote to memory of 1660	2256	rundll32.exe	28
PID 2256 wrote to memory of 1660	2256	rundll32.exe	28
PID 1660 wrote to memory of 2884	1660	rundll32.exe	29
PID 1660 wrote to memory of 2884	1660	rundll32.exe	29
PID 1660 wrote to memory of 2884	1660	rundll32.exe	29
PID 1660 wrote to memory of 2884	1660	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 248
    3⤵
    - Program crash
    PID:2884

memory/1660-0-0x000000006AF00000-0x000000006AF0D000-memory.dmp

Filesize
52KB

Download