3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:19

Target

$PLUGINSDIR/InstallOptionsEx.dll
Size

128KB
MD5

129b0668093a10e2a704a846c74a2ae8
SHA1

d16c6e7d449b9b81b9f67e29f5b08a47a1534072
SHA256

3a2593bcf62fc1d085bd2eafdbf762eb82b3b8a0619ba470eefe4df622ae783c
SHA512

b96e911f503176d074b6ee7d9ca6735b2fd3474b1e34867addbdb7717300aaf7cbdeabe3c536df652327dd3063009d44fa33861bb7fcc4208d368e5b32357dfb
SSDEEP

1536:MhdCp8I6g5rD48du2H1qqja40oal19wgBOxnu3TbNbFgb9j+WIwv4Q9QZatxt0tF:gdxg5QC0/lw8tub9Tv44Iat3wok

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1084 2184 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1084	2184	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1996 wrote to memory of 2184	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2184	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2184	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2184	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2184	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2184	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2184	1996	rundll32.exe	rundll32.exe
PID 2184 wrote to memory of 1084	2184	rundll32.exe	WerFault.exe
PID 2184 wrote to memory of 1084	2184	rundll32.exe	WerFault.exe
PID 2184 wrote to memory of 1084	2184	rundll32.exe	WerFault.exe
PID 2184 wrote to memory of 1084	2184	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptionsEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptionsEx.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 244
3⤵
- Program crash
PID:1084