ea9838d9488c2e216aa4796f04fbf4862287d960808b9231c0755af4f6e52dc1

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 13:11

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

7e49eb67f1f3c62bb8c4b0a868b30645
SHA1

2be42e3c6059485bc3b624a537ab1fb36a10a263
SHA256

17f0946e0847bbaa6a06eb58aead13fce22a8606e9b3744cd2241debdf8d8bae
SHA512

469c28b6da5b9499fd417f8cd74414d6c6edcbe6567eecc9421a69797a77ec323936deb96cd151611da57e311074ec0c56d82a9800d7aebac9538a947284ff9e
SSDEEP

192:/6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTSK72dwF7dBdcQOz:/6JaVh4I5rpPbTS+BdhO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	2308	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2308	1440	rundll32.exe	31
PID 1440 wrote to memory of 2308	1440	rundll32.exe	31
PID 1440 wrote to memory of 2308	1440	rundll32.exe	31
PID 1440 wrote to memory of 2308	1440	rundll32.exe	31
PID 1440 wrote to memory of 2308	1440	rundll32.exe	31
PID 1440 wrote to memory of 2308	1440	rundll32.exe	31
PID 1440 wrote to memory of 2308	1440	rundll32.exe	31
PID 2308 wrote to memory of 2500	2308	rundll32.exe	32
PID 2308 wrote to memory of 2500	2308	rundll32.exe	32
PID 2308 wrote to memory of 2500	2308	rundll32.exe	32
PID 2308 wrote to memory of 2500	2308	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 244
    3⤵
    - Program crash
    PID:2500