7c5b449226d2c3e8e65341baffb10b9393282d53b7f6fb164ed788ca2967bb99

Analysis

max time kernel
142s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 23:59

Target
$PLUGINSDIR/InstallOptions.dll
Size 30KB
Sample240930-31pf4s1cpr
SHA256 c555c346cc1f80ff0cb9aeaab8875a10c15ea4e5cf445a0f1597363fcf686924
MD5 a7d3a18ddc6206b7d980a40700ea6619
SHA1 2da1598e44a0d7541c236d678bfffb28de805c08
SHA512 53bffcd80bf3b8da2c1576b57bf4f993abed8a8c45f3831db4a983f05651bb6c22678b903e0c66fe2bc303fa2c8ef9b333826a998e0bf96719e4914c62efa374
SSDEEP 384:U0gEkzxOCEhrPa9EGCuvLjMVAKZv7HTw+GkuKnb/N1f9J61j0G8mnWvr:U/0CE5a9ED6LWbcBkHpS
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2640	2108	rundll32.exe	30
PID 2108 wrote to memory of 2640	2108	rundll32.exe	30
PID 2108 wrote to memory of 2640	2108	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2108 -s 172
  2⤵
  PID:2640