0891ddb6b4cf9b491981c9065e734f302613c64828c811b8742a85e25fa7f60c | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 14:20

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

7e49eb67f1f3c62bb8c4b0a868b30645
SHA1

2be42e3c6059485bc3b624a537ab1fb36a10a263
SHA256

17f0946e0847bbaa6a06eb58aead13fce22a8606e9b3744cd2241debdf8d8bae
SHA512

469c28b6da5b9499fd417f8cd74414d6c6edcbe6567eecc9421a69797a77ec323936deb96cd151611da57e311074ec0c56d82a9800d7aebac9538a947284ff9e
SSDEEP

192:/6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTSK72dwF7dBdcQOz:/6JaVh4I5rpPbTS+BdhO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2136 1620 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2188 wrote to memory of 1620	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1620	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1620	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1620	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1620	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1620	2188	rundll32.exe	rundll32.exe
PID 2188 wrote to memory of 1620	2188	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 2136	1620	rundll32.exe	WerFault.exe
PID 1620 wrote to memory of 2136	1620	rundll32.exe	WerFault.exe
PID 1620 wrote to memory of 2136	1620	rundll32.exe	WerFault.exe
PID 1620 wrote to memory of 2136	1620	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 244
3⤵
- Program crash
PID:2136

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...