8f3cfcedaf845387e4f7d07c77db62ad6f3c6856995ed8e0d1cdcecef17e0bbc

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 09:04

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

8d5a5529462a9ba1ac068ee0502578c7
SHA1

875e651e302ce0bfc8893f341cf19171fee25ea5
SHA256

e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790
SHA512

101da2c33f47bd85b8934318e0f0b72f820afc928a2a21e2c7823875e3a0e830f7c67f42b4c2f30596eaa073617790c89700c0d95b7949ec617e52800b61d462
SSDEEP

192:W4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjAK72dwF7dBOne:3n3T5KdHCMRD/R1cOnrjA+BO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
832	2320	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2320	2696	rundll32.exe	28
PID 2696 wrote to memory of 2320	2696	rundll32.exe	28
PID 2696 wrote to memory of 2320	2696	rundll32.exe	28
PID 2696 wrote to memory of 2320	2696	rundll32.exe	28
PID 2696 wrote to memory of 2320	2696	rundll32.exe	28
PID 2696 wrote to memory of 2320	2696	rundll32.exe	28
PID 2696 wrote to memory of 2320	2696	rundll32.exe	28
PID 2320 wrote to memory of 832	2320	rundll32.exe	29
PID 2320 wrote to memory of 832	2320	rundll32.exe	29
PID 2320 wrote to memory of 832	2320	rundll32.exe	29
PID 2320 wrote to memory of 832	2320	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 240
    3⤵
    - Program crash
    PID:832