3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449

Analysis

max time kernel
139s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:19

Target

$PLUGINSDIR/InstallOptionsEx.dll
Size

128KB
MD5

129b0668093a10e2a704a846c74a2ae8
SHA1

d16c6e7d449b9b81b9f67e29f5b08a47a1534072
SHA256

3a2593bcf62fc1d085bd2eafdbf762eb82b3b8a0619ba470eefe4df622ae783c
SHA512

b96e911f503176d074b6ee7d9ca6735b2fd3474b1e34867addbdb7717300aaf7cbdeabe3c536df652327dd3063009d44fa33861bb7fcc4208d368e5b32357dfb
SSDEEP

1536:MhdCp8I6g5rD48du2H1qqja40oal19wgBOxnu3TbNbFgb9j+WIwv4Q9QZatxt0tF:gdxg5QC0/lw8tub9Tv44Iat3wok

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3668 4588 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3668	4588	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2540 wrote to memory of 4588	2540	rundll32.exe	rundll32.exe
PID 2540 wrote to memory of 4588	2540	rundll32.exe	rundll32.exe
PID 2540 wrote to memory of 4588	2540	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptionsEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2540

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptionsEx.dll,#1
2⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 636
3⤵
- Program crash
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4588 -ip 4588
1⤵
PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4612,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
1⤵
PID:2484