315c37dc5ea525d5b671bd6611d89c04027d094926149c0fb2bea1474a8368dc

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 05:16

Target

$PLUGINSDIR/InstallOptions.dll
Size

12KB
MD5

29459d9ee2bce32ed937fb1f965f9d5e
SHA1

8fff45ed45f3af8f8c248eba9a1c02c9c5fc911d
SHA256

ad07968b7d93ef19e10e1deb52e0c912e96dde30c0a49a0239daf176fd4c9ef5
SHA512

d4ef4eadb0f53e7086a1d242bf7f745ad79d83d9ecbfaa283cf0dd499271a804589a575040bb20d5c98e86197cc65ca05ab1a358c556ea82a3e297d0255015a6
SSDEEP

384:oKlm7i+c3QW6ckPhyDEaLnH2bbBBIXwZ:dqi8BcyhEhLWbbTI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
772	2468	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2468	2052	rundll32.exe	30
PID 2052 wrote to memory of 2468	2052	rundll32.exe	30
PID 2052 wrote to memory of 2468	2052	rundll32.exe	30
PID 2052 wrote to memory of 2468	2052	rundll32.exe	30
PID 2052 wrote to memory of 2468	2052	rundll32.exe	30
PID 2052 wrote to memory of 2468	2052	rundll32.exe	30
PID 2052 wrote to memory of 2468	2052	rundll32.exe	30
PID 2468 wrote to memory of 772	2468	rundll32.exe	31
PID 2468 wrote to memory of 772	2468	rundll32.exe	31
PID 2468 wrote to memory of 772	2468	rundll32.exe	31
PID 2468 wrote to memory of 772	2468	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 244
    3⤵
    - Program crash
    PID:772