3c3c4b39f9355765dc75b7a893bbe52469f83afb9e5d609b7b74d9edfa415609

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:48

Target

$PLUGINSDIR/InstallOptions.dll
Size

15KB
MD5

f8d9d9418e6e1827ed2b53dd930e48fb
SHA1

c78b0e5b274dbbfd032a0f3ed795d82d5ea617c8
SHA256

2a2878b54550178144665d4c5f67309f71f1089679ae0f84fa419b8a309a88e4
SHA512

510ac31f9e330ec2e6133c1cbe775a955b79b94dc5a84d94b2c59d9b513c35f3786ff8a7f706d04ec2503a4ffc16535624a34e0dcc53e91eedd2321691b617fc
SSDEEP

192:eMGGr8JZYGO9QQr5aQbf1QuQVOmDsjcdOISYKoTs11929WtshLAzuy:eMGu8Jy1ai5aZBptdYYKCs/Yos

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2024 1736 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2024	1736	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2072 wrote to memory of 1736	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1736	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1736	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1736	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1736	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1736	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1736	2072	rundll32.exe	rundll32.exe
PID 1736 wrote to memory of 2024	1736	rundll32.exe	WerFault.exe
PID 1736 wrote to memory of 2024	1736	rundll32.exe	WerFault.exe
PID 1736 wrote to memory of 2024	1736	rundll32.exe	WerFault.exe
PID 1736 wrote to memory of 2024	1736	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 248
3⤵
- Program crash
PID:2024