79a662da8d43c7999394e678e01b340e73a04af8734bdda31359a7c3ef89754f

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 18:53

Target

$PLUGINSDIR/nsisos.dll
Size

5KB
MD5

69806691d649ef1c8703fd9e29231d44
SHA1

e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA256

ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
SHA512

5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb
SSDEEP

48:6EyuygeHCfxwU5x+6kx/k1gONv27oBc2OkIrHHl:VeHCf2762kKsu7oGjkIrn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	2644	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2644	2208	rundll32.exe	27
PID 2208 wrote to memory of 2644	2208	rundll32.exe	27
PID 2208 wrote to memory of 2644	2208	rundll32.exe	27
PID 2208 wrote to memory of 2644	2208	rundll32.exe	27
PID 2208 wrote to memory of 2644	2208	rundll32.exe	27
PID 2208 wrote to memory of 2644	2208	rundll32.exe	27
PID 2208 wrote to memory of 2644	2208	rundll32.exe	27
PID 2644 wrote to memory of 2720	2644	rundll32.exe	28
PID 2644 wrote to memory of 2720	2644	rundll32.exe	28
PID 2644 wrote to memory of 2720	2644	rundll32.exe	28
PID 2644 wrote to memory of 2720	2644	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsisos.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 228
    3⤵
    - Program crash
    PID:2720