Analysis
-
max time kernel
445s -
max time network
447s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 21:46
Static task
static1
Behavioral task
behavioral1
Sample
HandBrake-1.7.3-x86_64-Win_GUI.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
HandBrake.Worker.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
HandBrake.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral6
Sample
hb.dll
Resource
win10v2004-20240419-en
General
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
15KB
-
MD5
d095b082b7c5ba4665d40d9c5042af6d
-
SHA1
2220277304af105ca6c56219f56f04e894b28d27
-
SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c
-
SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9
-
SSDEEP
192:EyGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTr11929WtshLAzgSrX8:EyNt+4t7uJalUnGesY7Lt8nCr/Yosa
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1252 1212 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2988 wrote to memory of 1212 2988 rundll32.exe 84 PID 2988 wrote to memory of 1212 2988 rundll32.exe 84 PID 2988 wrote to memory of 1212 2988 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#12⤵PID:1212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 6363⤵
- Program crash
PID:1252
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1212 -ip 12121⤵PID:4732