a61057334fb7d6db7df03849d1279d6d9d6829bce5b01a17741eec9b9e1c822a | Triage

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 19:38

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/InstallOptions.dll
Size

12KB
MD5

29459d9ee2bce32ed937fb1f965f9d5e
SHA1

8fff45ed45f3af8f8c248eba9a1c02c9c5fc911d
SHA256

ad07968b7d93ef19e10e1deb52e0c912e96dde30c0a49a0239daf176fd4c9ef5
SHA512

d4ef4eadb0f53e7086a1d242bf7f745ad79d83d9ecbfaa283cf0dd499271a804589a575040bb20d5c98e86197cc65ca05ab1a358c556ea82a3e297d0255015a6
SSDEEP

384:oKlm7i+c3QW6ckPhyDEaLnH2bbBBIXwZ:dqi8BcyhEhLWbbTI

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2616	1352	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1352	3540	rundll32.exe	81
PID 3540 wrote to memory of 1352	3540	rundll32.exe	81
PID 3540 wrote to memory of 1352	3540	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  PID:1352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 624
    3⤵
    - Program crash
    PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1352 -ip 1352
1⤵
PID:4024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads