6819331b357c7397ce401390ecc4ae876854e63af4135bbb4e92afb6c2e621c5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 19:48

Target

$PLUGINSDIR/NSISdl.dll
Size

12KB
MD5

a10c9c9f5474ed8c13ff5e182655eb9f
SHA1

ffa6073f6b1724183d570c368c3025430de1ee33
SHA256

17055e463a04435bdb5fea5d634af12a4678ff5d680196da230879ad24622ee3
SHA512

bd7222d4ee6516b9be7f498858812ebfa824f657ef5298cfc813ad91fdfb6129642232d4c47f2edc4c2b8d2619ba7530a5195d53e9017435e7e8ef742f60fdb5
SSDEEP

192:ATPN9E1B0OUrW7VymsS9WmaYqkzJqa5Maamy6J0WVpzuzzPzrR2Z+:ATzEbUrW9tWmaY/zJ+aFy6CWVUzDP8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	2532	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2532	2512	rundll32.exe	28
PID 2512 wrote to memory of 2532	2512	rundll32.exe	28
PID 2512 wrote to memory of 2532	2512	rundll32.exe	28
PID 2512 wrote to memory of 2532	2512	rundll32.exe	28
PID 2512 wrote to memory of 2532	2512	rundll32.exe	28
PID 2512 wrote to memory of 2532	2512	rundll32.exe	28
PID 2512 wrote to memory of 2532	2512	rundll32.exe	28
PID 2532 wrote to memory of 1864	2532	rundll32.exe	29
PID 2532 wrote to memory of 1864	2532	rundll32.exe	29
PID 2532 wrote to memory of 1864	2532	rundll32.exe	29
PID 2532 wrote to memory of 1864	2532	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 224
    3⤵
    - Program crash
    PID:1864