5a1191d2527486f195ab010ad2bd770019ea9c881496d757e2ba1b0f31115fba

Resubmissions

09/07/2024, 21:40

09/07/2024, 21:37

max time kernel
140s
max time network
20s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 21:37

Target
$PLUGINSDIR/InstallOptions.dll
Size 32KB
Sample240709-1gr2saxclm
SHA256 657672be6ea8a72fb4765074cfda019fb8fa4eacb3238a416c186f53919d7cf4
MD5 1f24c9859dd6639d0c752d7b96a2442d
SHA1 7014f711d1d06cdc3d5bae678aad29e8b9ebcfd2
SHA512 7a488b27031e76873623142e66355d45a2bcd13d0fe235b93db1f92bb5c6658c4b689131672cacdad7b5a3204fca3fdbe020066f442b3a0db17fcf85f3eabf96
SSDEEP 384:PnpIqrPKteJM6zAzlq0BnPr681qrSYc/RHXCtk6tztN4Ykvdv7WbHwyx1I83cwTv:PpI8yU0tmC/hS3NfgvtQt28PEslxo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
988	2508	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2508	1096	rundll32.exe	29
PID 1096 wrote to memory of 2508	1096	rundll32.exe	29
PID 1096 wrote to memory of 2508	1096	rundll32.exe	29
PID 1096 wrote to memory of 2508	1096	rundll32.exe	29
PID 1096 wrote to memory of 2508	1096	rundll32.exe	29
PID 1096 wrote to memory of 2508	1096	rundll32.exe	29
PID 1096 wrote to memory of 2508	1096	rundll32.exe	29
PID 2508 wrote to memory of 988	2508	rundll32.exe	30
PID 2508 wrote to memory of 988	2508	rundll32.exe	30
PID 2508 wrote to memory of 988	2508	rundll32.exe	30
PID 2508 wrote to memory of 988	2508	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 240
    3⤵
    - Program crash
    PID:988

memory/2508-0-0x0000000075290000-0x00000000752A4000-memory.dmp

Download