7c5b449226d2c3e8e65341baffb10b9393282d53b7f6fb164ed788ca2967bb99

Analysis

max time kernel
142s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 23:59

Target

$PLUGINSDIR/InstallOptions.dll
Size

30KB
MD5

a7d3a18ddc6206b7d980a40700ea6619
SHA1

2da1598e44a0d7541c236d678bfffb28de805c08
SHA256

c555c346cc1f80ff0cb9aeaab8875a10c15ea4e5cf445a0f1597363fcf686924
SHA512

53bffcd80bf3b8da2c1576b57bf4f993abed8a8c45f3831db4a983f05651bb6c22678b903e0c66fe2bc303fa2c8ef9b333826a998e0bf96719e4914c62efa374
SSDEEP

384:U0gEkzxOCEhrPa9EGCuvLjMVAKZv7HTw+GkuKnb/N1f9J61j0G8mnWvr:U/0CE5a9ED6LWbcBkHpS

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2108 wrote to memory of 2640	2108	rundll32.exe	WerFault.exe
PID 2108 wrote to memory of 2640	2108	rundll32.exe	WerFault.exe
PID 2108 wrote to memory of 2640	2108	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2108 -s 172
2⤵
PID:2640

memory/2108-0-0x000007FEFAF40000-0x000007FEFAF54000-memory.dmp

Filesize
80KB

Download