96e0f2a803195e87752de63e91566dfe74b565d80e3c36efd90d85ec1b3be632

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 20:33

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

34466cab38abcbc09ffac768d526f896
SHA1

2684f5f6c2b005cba812fc8cc1157777554fa3a3
SHA256

8b4a1e7bf076c20240eb0a46cbdc8b835cfd89265fb78a3c1c5339ab820d2c1c
SHA512

5c6ae996a81f0fd9d3efe4e61c8683eb833cb203a476772c06eadb48e10e34d05a8fc2c837cf663dcc3a37713bd86694c8eb251868aa5bb42c4b21ba8c8e8fc7
SSDEEP

192:qcOqW13v5z+dHeMR2QwHu5S9i/yULWWBZYJCSJyejAK72dwF7dBKEw:qcw13v5SdHeMRRKkwsejA+BV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2208	1036	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	28
PID 1036 wrote to memory of 2208	1036	rundll32.exe	29
PID 1036 wrote to memory of 2208	1036	rundll32.exe	29
PID 1036 wrote to memory of 2208	1036	rundll32.exe	29
PID 1036 wrote to memory of 2208	1036	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 244
    3⤵
    - Program crash
    PID:2208