6abf9fcec5883b6e4d70810e60bd2d8a133a1a62bc28ca5d17dcc6f45d35214a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 17:39

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

714e0ecd29f9ec555f350f38672726c7
SHA1

555b1492e782d7a30f280f2aecb64c642c1aaad3
SHA256

21fea4cf18de8e25d0ffa3375699150fcd04e6d470358696f2dffdd3fc09d7f3
SHA512

ced5814f25b688d1ede5a1395bcca69e1a0cba260104f156dc03de6ebb2015f6d832fed86ac234c36a10a75be33f489a63c8bd6111e3aaf4b078af1d94b00312
SSDEEP

192:qcOqQ13v5z+dHeMR2QwHu5S9i/yULWWBZYJCSJyejiK72dwF7dBKEw:qcW13v5SdHeMRRKkwseji+BV

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1992 1632 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1992	1632	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2368 wrote to memory of 1632	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1632	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1632	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1632	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1632	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1632	2368	rundll32.exe	rundll32.exe
PID 2368 wrote to memory of 1632	2368	rundll32.exe	rundll32.exe
PID 1632 wrote to memory of 1992	1632	rundll32.exe	WerFault.exe
PID 1632 wrote to memory of 1992	1632	rundll32.exe	WerFault.exe
PID 1632 wrote to memory of 1992	1632	rundll32.exe	WerFault.exe
PID 1632 wrote to memory of 1992	1632	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 244
    3⤵
    - Program crash
    PID:1992