47956348c95fc18492263d5dafb3433b725357c6c6bdd38f76987d03bc8855e6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 06:58

Target

$PLUGINSDIR/InstallOptions.dll
Size

12KB
MD5

29459d9ee2bce32ed937fb1f965f9d5e
SHA1

8fff45ed45f3af8f8c248eba9a1c02c9c5fc911d
SHA256

ad07968b7d93ef19e10e1deb52e0c912e96dde30c0a49a0239daf176fd4c9ef5
SHA512

d4ef4eadb0f53e7086a1d242bf7f745ad79d83d9ecbfaa283cf0dd499271a804589a575040bb20d5c98e86197cc65ca05ab1a358c556ea82a3e297d0255015a6
SSDEEP

384:oKlm7i+c3QW6ckPhyDEaLnH2bbBBIXwZ:dqi8BcyhEhLWbbTI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	2108	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2108	1968	rundll32.exe	28
PID 1968 wrote to memory of 2108	1968	rundll32.exe	28
PID 1968 wrote to memory of 2108	1968	rundll32.exe	28
PID 1968 wrote to memory of 2108	1968	rundll32.exe	28
PID 1968 wrote to memory of 2108	1968	rundll32.exe	28
PID 1968 wrote to memory of 2108	1968	rundll32.exe	28
PID 1968 wrote to memory of 2108	1968	rundll32.exe	28
PID 2108 wrote to memory of 2100	2108	rundll32.exe	29
PID 2108 wrote to memory of 2100	2108	rundll32.exe	29
PID 2108 wrote to memory of 2100	2108	rundll32.exe	29
PID 2108 wrote to memory of 2100	2108	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 244
    3⤵
    - Program crash
    PID:2100