610301aed845d5cf63c54e871c568f1b09ed5c4f697b804033f77384ca212d7c

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:34

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

5f35212d7e90ee622b10be39b09bd270
SHA1

c4bc9593902adf6daaef37e456dc6100d50d0925
SHA256

31944b93e44301974d9c6f810d2da792e34a53dcacd619a08cb0385ac59e513d
SHA512

7514810367f56d994c6d5703b56ac16124fab5dfdcfbe337d4413274c1ff9037a2ee623e49ab2fb6227412ab29fcc49a3ada1391910d44c2b5de0adeb3e7c2f0
SSDEEP

192:E4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjaK72dwF7dBOne:tn3T5KdHCMRD/R1cOnrja+BO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3056 2356 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3056	2356	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2352 wrote to memory of 2356	2352	rundll32.exe	rundll32.exe
PID 2352 wrote to memory of 2356	2352	rundll32.exe	rundll32.exe
PID 2352 wrote to memory of 2356	2352	rundll32.exe	rundll32.exe
PID 2352 wrote to memory of 2356	2352	rundll32.exe	rundll32.exe
PID 2352 wrote to memory of 2356	2352	rundll32.exe	rundll32.exe
PID 2352 wrote to memory of 2356	2352	rundll32.exe	rundll32.exe
PID 2352 wrote to memory of 2356	2352	rundll32.exe	rundll32.exe
PID 2356 wrote to memory of 3056	2356	rundll32.exe	WerFault.exe
PID 2356 wrote to memory of 3056	2356	rundll32.exe	WerFault.exe
PID 2356 wrote to memory of 3056	2356	rundll32.exe	WerFault.exe
PID 2356 wrote to memory of 3056	2356	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 240
3⤵
- Program crash
PID:3056