3383c78a3caacae4f82381f0d83ad26eea1e1be5b04613338e7455687393354b

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 00:57

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

eca460272800136da217dff3c8953df0
SHA1

64e9ec022913d66b58ab5a8dbbfe7dd35d077824
SHA256

fd74339ffd5a66781a333005f065a3978ca7916cc56e73ec9598262c72a33ff8
SHA512

f92ccca98551fde68db761f58ac36e76319dde137dd0cff80f0f67f473412000ffba774074416e6907049c6b4c71ccbc853c33f4e489ba2b4f50badc2739b747
SSDEEP

192:pKB8TmFxyTQdQbg9FkGuz9lhDGO8Fw+pzfVHAZT2K72dwF7dBG0XK:a8Tmr5dYQFkGUlqbpzfiT2+BG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3244	1736	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 1736	3280	rundll32.exe	89
PID 3280 wrote to memory of 1736	3280	rundll32.exe	89
PID 3280 wrote to memory of 1736	3280	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 644
    3⤵
    - Program crash
    PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1736 -ip 1736
1⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,4018838247141480194,10874272319406041522,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
1⤵
PID:2808