5a1191d2527486f195ab010ad2bd770019ea9c881496d757e2ba1b0f31115fba

Resubmissions

09-07-2024 21:40

09-07-2024 21:37

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 21:40

Target

$PLUGINSDIR/InstallOptions.dll
Size

32KB
MD5

1f24c9859dd6639d0c752d7b96a2442d
SHA1

7014f711d1d06cdc3d5bae678aad29e8b9ebcfd2
SHA256

657672be6ea8a72fb4765074cfda019fb8fa4eacb3238a416c186f53919d7cf4
SHA512

7a488b27031e76873623142e66355d45a2bcd13d0fe235b93db1f92bb5c6658c4b689131672cacdad7b5a3204fca3fdbe020066f442b3a0db17fcf85f3eabf96
SSDEEP

384:PnpIqrPKteJM6zAzlq0BnPr681qrSYc/RHXCtk6tztN4Ykvdv7WbHwyx1I83cwTv:PpI8yU0tmC/hS3NfgvtQt28PEslxo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2580	3032	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 3032	400	rundll32.exe	83
PID 400 wrote to memory of 3032	400	rundll32.exe	83
PID 400 wrote to memory of 3032	400	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 636
    3⤵
    - Program crash
    PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3032 -ip 3032
1⤵
PID:1688

memory/3032-0-0x00000000751D0000-0x00000000751E4000-memory.dmp

Filesize
80KB

Download