3383c78a3caacae4f82381f0d83ad26eea1e1be5b04613338e7455687393354b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 00:57

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

eca460272800136da217dff3c8953df0
SHA1

64e9ec022913d66b58ab5a8dbbfe7dd35d077824
SHA256

fd74339ffd5a66781a333005f065a3978ca7916cc56e73ec9598262c72a33ff8
SHA512

f92ccca98551fde68db761f58ac36e76319dde137dd0cff80f0f67f473412000ffba774074416e6907049c6b4c71ccbc853c33f4e489ba2b4f50badc2739b747
SSDEEP

192:pKB8TmFxyTQdQbg9FkGuz9lhDGO8Fw+pzfVHAZT2K72dwF7dBG0XK:a8Tmr5dYQFkGUlqbpzfiT2+BG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2256	1048	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 2232 wrote to memory of 1048	2232	rundll32.exe	31
PID 1048 wrote to memory of 2256	1048	rundll32.exe	32
PID 1048 wrote to memory of 2256	1048	rundll32.exe	32
PID 1048 wrote to memory of 2256	1048	rundll32.exe	32
PID 1048 wrote to memory of 2256	1048	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 244
    3⤵
    - Program crash
    PID:2256