61412215fb26d53852080768f435afcfa050319f0431cc1c4f0ac6e203eeb5e2

Analysis

max time kernel
91s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 02:01

Target
$PLUGINSDIR/InstallHelper.dll
Size 80KB
Sample240605-cf2ylabg45
SHA256 53c9cd1bbb9c595708ff00297694492135202649066551a354f0f8475e4c41c8
MD5 e8f6633f06b6b7e576fd764f97fe8573
SHA1 d149d067c9d53bcb8d20ac006da581a8e43daf84
SHA512 9587c452cdb4c103bb9347eb7f0ff43759ff4b7ba53de2d9446807b24b954af1547c227df05069a91c49f39dbd181f5890784101d74727deeffcc032b01cc6ca
SSDEEP 1536:SVuz5s65BWFCGH1Z9guNrCPHbSQ9uv5tmQ:SIz5lfo53WPH2+uBtm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2136	892	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 892	2900	rundll32.exe	81
PID 2900 wrote to memory of 892	2900	rundll32.exe	81
PID 2900 wrote to memory of 892	2900	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallHelper.dll,#1
  2⤵
  PID:892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 624
    3⤵
    - Program crash
    PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 892 -ip 892
1⤵
PID:404