13b01dfe788827f1fff3cc2f0ce82b68cc97d795bdc7efbe634115760bda8237

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 17:53

Target

$PLUGINSDIR/InstallOptions.dll
Size

12KB
MD5

d61d6c709e7947296603059f8bedeba9
SHA1

bdcfc90c358c82be43ef85727a7bdfebbd6d1b69
SHA256

65012a46603b7e13807938e2a61f3c2a60cced3fb3187dfab3e391705e2c3f63
SHA512

ed5a6efd1dd5e2119a9c523b9f9154e13552b3538bf72f4b8b02d6a9c808c3ae2ba7613d9e2b3395237461703f2da0a1482a52727ffcf6fc967552390dab0f2b
SSDEEP

384:sKlm7i+c3QW6ckPhyDEaLnL2bbBBIXwZ:5qi8BcyhEhLibbTI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1872	2236	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2844 wrote to memory of 2236	2844	rundll32.exe	28
PID 2236 wrote to memory of 1872	2236	rundll32.exe	29
PID 2236 wrote to memory of 1872	2236	rundll32.exe	29
PID 2236 wrote to memory of 1872	2236	rundll32.exe	29
PID 2236 wrote to memory of 1872	2236	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 244
    3⤵
    - Program crash
    PID:1872