88c871fe1cae64d0a72103a3df002e9a192e6061f4f08eba3859c395abe948da

Analysis

max time kernel
90s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 17:52

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

4cb36c62157fe5bf48aa7f20bc0a9eb0
SHA1

ca194fb9ab75fbf23a0eb0814fd44996b5959210
SHA256

a4774fa2602702951839d3d3a593f3b39e71e14c3fbab77bf6274935924d755b
SHA512

fd141c0b8ead070b2b266344ad6e804df24a2dd578f78285ece6e003de35b4dfdac1ebbcc0ce2ca6f0a4e5673fc0e26639dcc5073e4e474d4ddcca9c6f978cdd
SSDEEP

192:24n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjJK72dwF7dBOne:Xn3T5KdHCMRD/R1cOnrjJ+BO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1968	2120	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2120	1852	rundll32.exe	82
PID 1852 wrote to memory of 2120	1852	rundll32.exe	82
PID 1852 wrote to memory of 2120	1852	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  PID:2120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 636
    3⤵
    - Program crash
    PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2120 -ip 2120
1⤵
PID:1300