2b3aa9f8d949be0919837b8f00c79700c0db437a6a8f042fcff2ec4b2c03c584

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:15

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

5f35212d7e90ee622b10be39b09bd270
SHA1

c4bc9593902adf6daaef37e456dc6100d50d0925
SHA256

31944b93e44301974d9c6f810d2da792e34a53dcacd619a08cb0385ac59e513d
SHA512

7514810367f56d994c6d5703b56ac16124fab5dfdcfbe337d4413274c1ff9037a2ee623e49ab2fb6227412ab29fcc49a3ada1391910d44c2b5de0adeb3e7c2f0
SSDEEP

192:E4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjaK72dwF7dBOne:tn3T5KdHCMRD/R1cOnrja+BO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2560 2720 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2560	2720	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2612 wrote to memory of 2720	2612	rundll32.exe	rundll32.exe
PID 2612 wrote to memory of 2720	2612	rundll32.exe	rundll32.exe
PID 2612 wrote to memory of 2720	2612	rundll32.exe	rundll32.exe
PID 2612 wrote to memory of 2720	2612	rundll32.exe	rundll32.exe
PID 2612 wrote to memory of 2720	2612	rundll32.exe	rundll32.exe
PID 2612 wrote to memory of 2720	2612	rundll32.exe	rundll32.exe
PID 2612 wrote to memory of 2720	2612	rundll32.exe	rundll32.exe
PID 2720 wrote to memory of 2560	2720	rundll32.exe	WerFault.exe
PID 2720 wrote to memory of 2560	2720	rundll32.exe	WerFault.exe
PID 2720 wrote to memory of 2560	2720	rundll32.exe	WerFault.exe
PID 2720 wrote to memory of 2560	2720	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 244
3⤵
- Program crash
PID:2560