3c3c4b39f9355765dc75b7a893bbe52469f83afb9e5d609b7b74d9edfa415609

Analysis

max time kernel
134s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:48

Target

$PLUGINSDIR/InstallOptions.dll
Size

15KB
MD5

f8d9d9418e6e1827ed2b53dd930e48fb
SHA1

c78b0e5b274dbbfd032a0f3ed795d82d5ea617c8
SHA256

2a2878b54550178144665d4c5f67309f71f1089679ae0f84fa419b8a309a88e4
SHA512

510ac31f9e330ec2e6133c1cbe775a955b79b94dc5a84d94b2c59d9b513c35f3786ff8a7f706d04ec2503a4ffc16535624a34e0dcc53e91eedd2321691b617fc
SSDEEP

192:eMGGr8JZYGO9QQr5aQbf1QuQVOmDsjcdOISYKoTs11929WtshLAzuy:eMGu8Jy1ai5aZBptdYYKCs/Yos

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1652 540 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1652	540	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1524 wrote to memory of 540	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 540	1524	rundll32.exe	rundll32.exe
PID 1524 wrote to memory of 540	1524	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
2⤵
PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 636
3⤵
- Program crash
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 540 -ip 540
1⤵
PID:3484