3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:19

Target

$PLUGINSDIR/InstallOptions.dll
Size

15KB
MD5

786110d3394edf4bb5c14e3e9a49f9e6
SHA1

4adf64a5999a1a41870fedefba22f67840f36f3a
SHA256

3ccb4385cd22b5c69bc2583e181da4085477906c193f04eb5a400801e00dbcd5
SHA512

e85e49b492a04188c46c90fef6ba5b177f85c670848f902748ec1540839ffb2f5d88563c14026328dd2100a48979ff8e67e7af1eee70fea0eb477c78db4d9524
SSDEEP

192:JsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5mn8ozxGUWumle:JsUHd9GN2d2iwl0impATIPdAn8Ov6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2216 2296 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2216	2296	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2732 wrote to memory of 2296	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 2296	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 2296	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 2296	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 2296	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 2296	2732	rundll32.exe	rundll32.exe
PID 2732 wrote to memory of 2296	2732	rundll32.exe	rundll32.exe
PID 2296 wrote to memory of 2216	2296	rundll32.exe	WerFault.exe
PID 2296 wrote to memory of 2216	2296	rundll32.exe	WerFault.exe
PID 2296 wrote to memory of 2216	2296	rundll32.exe	WerFault.exe
PID 2296 wrote to memory of 2216	2296	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 244
3⤵
- Program crash
PID:2216