133f61cd4e91ef94b75353b070ea30ee51e5603ac91950e2f865dca16db318b0

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06-07-2024 15:56

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

eca460272800136da217dff3c8953df0
SHA1

64e9ec022913d66b58ab5a8dbbfe7dd35d077824
SHA256

fd74339ffd5a66781a333005f065a3978ca7916cc56e73ec9598262c72a33ff8
SHA512

f92ccca98551fde68db761f58ac36e76319dde137dd0cff80f0f67f473412000ffba774074416e6907049c6b4c71ccbc853c33f4e489ba2b4f50badc2739b747
SSDEEP

192:pKB8TmFxyTQdQbg9FkGuz9lhDGO8Fw+pzfVHAZT2K72dwF7dBG0XK:a8Tmr5dYQFkGUlqbpzfiT2+BG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1252	4184	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4184	4072	rundll32.exe	82
PID 4072 wrote to memory of 4184	4072	rundll32.exe	82
PID 4072 wrote to memory of 4184	4072	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  PID:4184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 636
    3⤵
    - Program crash
    PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4184 -ip 4184
1⤵
PID:3536