3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:23

Target

$PLUGINSDIR/InstallOptionsEx.dll
Size

128KB
MD5

129b0668093a10e2a704a846c74a2ae8
SHA1

d16c6e7d449b9b81b9f67e29f5b08a47a1534072
SHA256

3a2593bcf62fc1d085bd2eafdbf762eb82b3b8a0619ba470eefe4df622ae783c
SHA512

b96e911f503176d074b6ee7d9ca6735b2fd3474b1e34867addbdb7717300aaf7cbdeabe3c536df652327dd3063009d44fa33861bb7fcc4208d368e5b32357dfb
SSDEEP

1536:MhdCp8I6g5rD48du2H1qqja40oal19wgBOxnu3TbNbFgb9j+WIwv4Q9QZatxt0tF:gdxg5QC0/lw8tub9Tv44Iat3wok

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3372 740 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3372	740	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3972 wrote to memory of 740	3972	rundll32.exe	rundll32.exe
PID 3972 wrote to memory of 740	3972	rundll32.exe	rundll32.exe
PID 3972 wrote to memory of 740	3972	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptionsEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3972

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptionsEx.dll,#1
2⤵
PID:740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 636
3⤵
- Program crash
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 740 -ip 740
1⤵
PID:2488