61412215fb26d53852080768f435afcfa050319f0431cc1c4f0ac6e203eeb5e2

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 02:01

Target
$PLUGINSDIR/InstallHelper.dll
Size 80KB
Sample240605-cf2ylabg45
SHA256 53c9cd1bbb9c595708ff00297694492135202649066551a354f0f8475e4c41c8
MD5 e8f6633f06b6b7e576fd764f97fe8573
SHA1 d149d067c9d53bcb8d20ac006da581a8e43daf84
SHA512 9587c452cdb4c103bb9347eb7f0ff43759ff4b7ba53de2d9446807b24b954af1547c227df05069a91c49f39dbd181f5890784101d74727deeffcc032b01cc6ca
SSDEEP 1536:SVuz5s65BWFCGH1Z9guNrCPHbSQ9uv5tmQ:SIz5lfo53WPH2+uBtm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2476	2056	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 1368 wrote to memory of 2056	1368	rundll32.exe	28
PID 2056 wrote to memory of 2476	2056	rundll32.exe	29
PID 2056 wrote to memory of 2476	2056	rundll32.exe	29
PID 2056 wrote to memory of 2476	2056	rundll32.exe	29
PID 2056 wrote to memory of 2476	2056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallHelper.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 228
    3⤵
    - Program crash
    PID:2476